CVE-2018-16269

Published: Jan 22, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.

Affected (10)

Products: Samsung: Galaxy Gear Firmware, Gear 2 Firmware, Gear Live Firmware, Gear S Firmware, Gear S2 Firmware, Gear S3 Firmware, Gear Sport Firmware, Gear Fit Firmware, Gear Fit 2 Firmware, Gear Fit 2 Pro Firmware

10 products

Gear Fit 2 Pro Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Galaxy Gear Firmware	Before re2

Running on/with	Platform Versions
Samsung Galaxy Gear	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Gear 2 Firmware	Before re2

Running on/with	Platform Versions
Samsung Gear 2	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Gear Live Firmware	Before re2

Running on/with	Platform Versions
Samsung Gear Live	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Gear S Firmware	Before re2

Running on/with	Platform Versions
Samsung Gear S	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Gear S2 Firmware	Before re2

Running on/with	Platform Versions
Samsung Gear S2	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Gear S3 Firmware	Before re2

Running on/with	Platform Versions
Samsung Gear S3	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Gear Sport Firmware	Before re2

Running on/with	Platform Versions
Samsung Gear Sport	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Gear Fit Firmware	Before re2

Running on/with	Platform Versions
Samsung Gear Fit	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Gear Fit 2 Firmware	Before re2

Running on/with	Platform Versions
Samsung Gear Fit 2	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Gear Fit 2 Pro Firmware	Before re2

Running on/with	Platform Versions
Samsung Gear Fit 2 Pro	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be

Source: cve@mitre.org

ExploitThird Party Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.