← Back

CVE-2018-14825

nvd nist
Published: Sep 24, 2018Modified: Nov 21, 2024

JSON object

Loading...
5.8
Vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Exploitability: 1.0 / Impact: 4.7
Source: NVD

Description

On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android OS 6.0, CN75 running Android OS 6.0, CN75e running Android OS 6.0, CT50 running Android OS 6.0, D75e running Android OS 6.0, CT50 running Android OS 4.4, D75e running Android OS 4.4, CN51 running Android OS 6.0, EDA50k running Android 4.4, EDA50 running Android OS 7.1, EDA50k running Android OS 7.1, EDA70 running Android OS 7.1, EDA60k running Android OS 7.1, and EDA51 running Android OS 8.1), a skilled attacker with advanced knowledge of the target system could exploit this vulnerability by creating an application that would successfully bind to the service and gain elevated system privileges. This could enable the attacker to obtain access to keystrokes, passwords, personal identifiable information, photos, emails, or business-critical documents.

Affected (14)

Honeywell
14 products
Cn80
Ct40
Ct60
Eda50
Eda60k
Eda70
Ck75
Cn51
Cn75
Cn75e
Ct50
D75e
Eda50k
Eda51
Configuration A
6 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Cn80
All versions
Ct40
All versions
Ct60
All versions
Eda50
All versions
Eda60k
All versions
Eda70
All versions
Running on/withPlatform Versions
Google
Android
Version 7.1.0
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Ck75
All versions
Cn51
All versions
Cn75
All versions
Cn75e
All versions
Configuration C
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ct50
All versions
D75e
All versions
Running on/withPlatform Versions
Google
Android
Version 6.0
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Eda50k
All versions
Running on/withPlatform Versions
Google
Android
Version 4.4
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Eda51
All versions
Running on/withPlatform Versions
Google
Android
Version 8.1

Related CWEs

CWE-269
Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-732
Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (6)

Source: ics-cert@hq.dhs.gov
Third Party AdvisoryVDB Entry
Source: ics-cert@hq.dhs.gov
Third Party Advisory
Source: ics-cert@hq.dhs.gov
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource

Timeline

No history available yet.