Sign-up

ID

VAR-201812-0113


CVE

CVE-2018-14998


TITLE

Leagoo P1 Android Vulnerabilities related to authorization, authority, and access control in devices

Trust: 0.8

sources: JVNDB: JVNDB-2018-014508

DESCRIPTION

The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a hidden root privilege escalation capability to achieve command execution as the root user. They have made modifications that allow a user with physical access to the device to obtain a root shell via ADB by modifying read-only system properties at runtime. Specifically, modifying the ro.debuggable and the ro.secure system properties to a certain value and then restarting the ADB daemon allows for a root shell to be obtained via ADB. Leagoo P1 Android Devices have vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Leagoo P1 is a smart phone based on Android platform produced by Leagoo Malaysia. There is a security vulnerability in Leagoo P1 (the Build fingerprint used is sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys). An attacker in close physical proximity could exploit this vulnerability to execute commands as the root user

Trust: 1.71

sources: NVD: CVE-2018-14998 // JVNDB: JVNDB-2018-014508 // VULHUB: VHN-125213

AFFECTED PRODUCTS

vendor:leagoomodel:p1scope:eqversion: -

Trust: 1.0

vendor:leagoo globalmodel:p1scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2018-014508 // NVD: CVE-2018-14998

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-14998
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-14998
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201812-1254
value: MEDIUM

Trust: 0.6

VULHUB: VHN-125213
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-14998
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-125213
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-14998
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-125213 // JVNDB: JVNDB-2018-014508 // CNNVD: CNNVD-201812-1254 // NVD: CVE-2018-14998

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.1

problemtype:CWE-264

Trust: 0.9

sources: VULHUB: VHN-125213 // JVNDB: JVNDB-2018-014508 // NVD: CVE-2018-14998

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201812-1254

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-014508

PATCH
title:P1url:https://www.leagoo.com/products/P1/spec.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-014508

EXTERNAL IDS
db:NVDid:CVE-2018-14998
Trust: 2.5
db:JVNDBid:JVNDB-2018-014508
Trust: 0.8
db:CNNVDid:CNNVD-201812-1254
Trust: 0.7
db:VULHUBid:VHN-125213
Trust: 0.1
sources:
            
            
            VULHUB: VHN-125213 // 
            
            
            
            JVNDB: JVNDB-2018-014508 // 
            
            
            
            CNNVD: CNNVD-201812-1254 // 
            
            
            
            NVD: CVE-2018-14998

REFERENCES
url:https://www.kryptowire.com/portal/wp-content/uploads/2018/12/defcon-26-johnson-and-stavrou-vulnerable-out-of-the-box-an-eval-of-android-carrier-devices-wp-updated.pdf
Trust: 2.5
url:https://www.kryptowire.com/portal/android-firmware-defcon-2018/
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14998
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-14998
Trust: 0.8
sources:
            
            
            VULHUB: VHN-125213 // 
            
            
            
            JVNDB: JVNDB-2018-014508 // 
            
            
            
            CNNVD: CNNVD-201812-1254 // 
            
            
            
            NVD: CVE-2018-14998

SOURCES
db:VULHUBid:VHN-125213
db:JVNDBid:JVNDB-2018-014508
db:CNNVDid:CNNVD-201812-1254
db:NVDid:CVE-2018-14998

LAST UPDATE DATE
2024-11-23T22:17:15.076000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-125213date:2019-10-03T00:00:00
db:JVNDBid:JVNDB-2018-014508date:2019-03-25T00:00:00
db:CNNVDid:CNNVD-201812-1254date:2019-10-23T00:00:00
db:NVDid:CVE-2018-14998date:2024-11-21T03:50:18.340

SOURCES RELEASE DATE
db:VULHUBid:VHN-125213date:2018-12-28T00:00:00
db:JVNDBid:JVNDB-2018-014508date:2019-03-25T00:00:00
db:CNNVDid:CNNVD-201812-1254date:2018-12-29T00:00:00
db:NVDid:CVE-2018-14998date:2018-12-28T21:29:00.747