Details of VAR-202001-1427

ID

VAR-202001-1427

CVE

CVE-2018-16270

TITLE

Samsung Galaxy Gear Series permission vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-016198

DESCRIPTION

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path

Trust: 1.62

sources: NVD: CVE-2018-16270 // JVNDB: JVNDB-2018-016198

IOT TAXONOMY

category:

['wearable device']

sub_category:

smartwatch

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:	samsung	model:	gear fit 2	scope:	lt	version:	re2	Trust: 1.0
vendor:	samsung	model:	gear fit	scope:	lt	version:	re2	Trust: 1.0
vendor:	samsung	model:	gear sport	scope:	lt	version:	re2	Trust: 1.0
vendor:	samsung	model:	gear live	scope:	lt	version:	re2	Trust: 1.0
vendor:	samsung	model:	gear s3	scope:	lt	version:	re2	Trust: 1.0
vendor:	samsung	model:	gear s2	scope:	lt	version:	re2	Trust: 1.0
vendor:	samsung	model:	gear s	scope:	lt	version:	re2	Trust: 1.0
vendor:	samsung	model:	gear 2	scope:	lt	version:	re2	Trust: 1.0
vendor:	samsung	model:	galaxy gear	scope:	lt	version:	re2	Trust: 1.0
vendor:	samsung	model:	gear fit 2 pro	scope:	lt	version:	re2	Trust: 1.0
vendor:	サムスン	model:	gear fit 2 pro	scope:	eq	version:	re2 or less	Trust: 0.8
vendor:	サムスン	model:	gear s	scope:	eq	version:	re2 or less	Trust: 0.8
vendor:	サムスン	model:	galaxy gear	scope:	eq	version:	re2 or less	Trust: 0.8
vendor:	サムスン	model:	gear s3	scope:	eq	version:	re2 or less	Trust: 0.8
vendor:	サムスン	model:	gear 2	scope:	eq	version:	re2 or less	Trust: 0.8
vendor:	サムスン	model:	gear sport	scope:	eq	version:	re2 or less	Trust: 0.8
vendor:	サムスン	model:	gear s2	scope:	eq	version:	re2 or less	Trust: 0.8
vendor:	サムスン	model:	gear fit	scope:	eq	version:	re2 or less	Trust: 0.8
vendor:	サムスン	model:	gear live	scope:	eq	version:	re2 or less	Trust: 0.8
vendor:	サムスン	model:	gear fit 2	scope:	eq	version:	re2 or less	Trust: 0.8

sources: JVNDB: JVNDB-2018-016198 // NVD: CVE-2018-16270

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-16270
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-16270
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202001-993
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2018-16270
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2018-16270
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2018-16270
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2018-016198 // CNNVD: CNNVD-202001-993 // NVD: CVE-2018-16270

PROBLEMTYPE DATA

problemtype:	CWE-269	Trust: 1.0
problemtype:	Improper authority management (CWE-269) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2018-016198 // NVD: CVE-2018-16270

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202001-993

PATCH

title:

Top Page

url:

https://www.galaxymobile.jp/

Trust: 0.8

sources: JVNDB: JVNDB-2018-016198

EXTERNAL IDS

db:	NVD	id:	CVE-2018-16270	Trust: 2.5
db:	JVNDB	id:	JVNDB-2018-016198	Trust: 0.8
db:	CNNVD	id:	CNNVD-202001-993	Trust: 0.6
db:	OTHER	id:	NONE	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2018-016198 // CNNVD: CNNVD-202001-993 // NVD: CVE-2018-16270

REFERENCES

url:	https://www.youtube.com/watch?v=3idgbwbot-g&feature=youtu.be	Trust: 2.4
url:	https://media.defcon.org/def%20con%2026/def%20con%2026%20presentations/dongsung%20kim%20and%20hyoung%20kee%20choi%20-%20updated/defcon-26-dongsung-kim-and-hyoung-kee-choi-your-watch-can-watch-you-updated.pdf	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2018-16270	Trust: 1.4
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2018-016198 // CNNVD: CNNVD-202001-993 // NVD: CVE-2018-16270

SOURCES

db:	OTHER	id:	-
db:	JVNDB	id:	JVNDB-2018-016198
db:	CNNVD	id:	CNNVD-202001-993
db:	NVD	id:	CVE-2018-16270

LAST UPDATE DATE

2025-01-30T21:22:27.378000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2018-016198	date:	2020-02-13T00:00:00
db:	CNNVD	id:	CNNVD-202001-993	date:	2021-01-05T00:00:00
db:	NVD	id:	CVE-2018-16270	date:	2024-11-21T03:52:25.633

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2018-016198	date:	2020-02-13T00:00:00
db:	CNNVD	id:	CNNVD-202001-993	date:	2020-01-22T00:00:00
db:	NVD	id:	CVE-2018-16270	date:	2020-01-22T14:15:11.213