Vulnerability Description
OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked.
CVSS Score
4.6
MEDIUM
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oneplus | App Locker | <= 2020-10-06 |
Related Weaknesses (CWE)
References
- https://medium.com/%40bugsbunnyy1107/the-tell-tale-of-cve-in-oneplus-phones-91e9
- https://support.oneplus.com/app/answers/detail/a_id/301/~/how-to-use-app-lockerThird Party Advisory
- https://medium.com/%40bugsbunnyy1107/the-tell-tale-of-cve-in-oneplus-phones-91e9
- https://support.oneplus.com/app/answers/detail/a_id/301/~/how-to-use-app-lockerThird Party Advisory
FAQ
What is CVE-2020-13626?
CVE-2020-13626 is a vulnerability with a CVSS score of 4.6 (MEDIUM). OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked.
How severe is CVE-2020-13626?
CVE-2020-13626 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-13626?
Check the references section above for vendor advisories and patch information. Affected products include: Oneplus App Locker.