← Back

CVE-2020-28055

nvd nist
Published: Nov 10, 2020Modified: Nov 21, 2024

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. An attacker, such as a malicious APK or local unprivileged user could perform fake system upgrades by writing to the /data/vendor/upgrage folder.

Affected (7)

Tcl
7 products
32s330 Firmware
40s330 Firmware
43s434 Firmware
50s434 Firmware
55s434 Firmware
65s434 Firmware
75s434 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
32s330 Firmware
Before v8-r851t10-lf1v091
Running on/withPlatform Versions
Tcl
32s330
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
40s330 Firmware
Before v8-r851t10-lf1v091
Running on/withPlatform Versions
Tcl
40s330
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
43s434 Firmware
Before v8-r851t02-lf1v440
Running on/withPlatform Versions
Tcl
43s434
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
50s434 Firmware
Before v8-r851t02-lf1v440
Running on/withPlatform Versions
Tcl
50s434
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
55s434 Firmware
Before v8-r851t02-lf1v440
Running on/withPlatform Versions
Tcl
55s434
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
65s434 Firmware
Before v8-r851t02-lf1v440
Running on/withPlatform Versions
Tcl
65s434
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
75s434 Firmware
Before v8-r851t02-lf1v440
Running on/withPlatform Versions
Tcl
75s434
All versions

Related CWEs

CWE-732
Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (20)

Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.