Sign-up

ID

VAR-202102-0137


CVE

CVE-2019-20468


TITLE

TK-Star Q90 Junior GPS horloge  For devices  SeTracker2  Inappropriate Default Permission Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-016204

DESCRIPTION

An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS. TK-Star Q90 Junior GPS horloge For devices SeTracker2 Is vulnerable to incorrect default permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. ------------------------------------------ [Additional Information] The manifest of Q90 declares the use of permissions. However some of the declared functions are not required for proper functioning of the application. The following application permissions are not required: android.permission.SYSTEM_ALERT_WINDOW: Allows an app to create windows using the type WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.WRITE_EXTERNAL_STORAGE: Declaring these permissions for debugging purposes is common practice, but they should not be carried over to production releases of the app. android.permission.READ_EXTERNAL_STORAGE. android.permission.CHANGE_WIFI_STATE: Allows applications to change Wi-Fi connectivity state. android.permission.CHANGE_CONFIGURATION: Allows access to the list of accounts (including usernames) in the Accounts Service. android.permission.READ_CONTACTS: Allows an application to read the user's contacts data. android.permission.MANAGE_ACCOUNTS: The application can request create or access accounts stored locally in the AccountManager. android.permission.GET_ACCOUNTS: Allows access to the list of accounts (including usernames) in the Accounts Service. android.permission.BLUETOOTH: Allows applications to connect to paired bluetooth devices. android.permission.BLUETOOTH_ADMIN: Allows applications to discover and pair bluetooth devices. android.permission.GET_TASKS: Allows the app to retrieve information about currently and recently running tasks. This may allow the app to discover information about which applications are used on the device. The backup element (android:allowBackup) is manually set to true. The sheer amount of unnecessary permissions, with potential high security impact, (e.g. reading all contact information, retrieving usernames, passwords and other personal information stored on the device, changing system settings, connecting to other devices) provides the application with an unnecessarily large amount of sensitive information and (potential) control over older (API 16-22) mobile devices and raises numerous questions regarding the intentions behind this application. ------------------------------------------ [Vulnerability Type] Insecure Permissions ------------------------------------------ [Vendor of Product] TK-star ------------------------------------------ [Affected Product Code Base] TK-Star Q90 Junior GPS horloge - 3.1042.9.8656 ------------------------------------------ [Affected Component] Q90 SeTracker2 ------------------------------------------ [Attack Type] Local ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [CVE Impact Other] Excessive permissions can enable malicious behaviour. ------------------------------------------ [Attack Vectors] to exploit the vulnerability, the application code must be updated with malicious intent. ------------------------------------------ [Has vendor confirmed or acknowledged the vulnerability?] true ------------------------------------------ [Discoverer] Dennis van Warmerdam, Jasper Nota, Jim Blankendaal ------------------------------------------ [Reference] https://www.tk-star.com Use CVE-2019-20468

Trust: 1.8

sources: NVD: CVE-2019-20468 // JVNDB: JVNDB-2019-016204 // VULMON: CVE-2019-20468 // PACKETSTORM: 179817

AFFECTED PRODUCTS

vendor:tk starmodel:q90 junior gps horlogescope:eqversion:3.1042.9.8656

Trust: 1.0

vendor:tkstarmodel:q90 junior gps horlogescope: - version: -

Trust: 0.8

vendor:tkstarmodel:q90 junior gps horlogescope:eqversion:q90 junior gps horloge firmware 3.1042.9.8656

Trust: 0.8

vendor:tkstarmodel:q90 junior gps horlogescope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2019-016204 // NVD: CVE-2019-20468

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-20468
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-20468
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202102-012
value: CRITICAL

Trust: 0.6

VULMON: CVE-2019-20468
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-20468
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2019-20468
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-20468
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2019-20468 // JVNDB: JVNDB-2019-016204 // CNNVD: CNNVD-202102-012 // NVD: CVE-2019-20468

PROBLEMTYPE DATA

problemtype:CWE-276

Trust: 1.0

problemtype:Inappropriate default permissions (CWE-276) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2019-016204 // NVD: CVE-2019-20468

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202102-012

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202102-012

PATCH

title:Top Pageurl:https://www.tk-star.com/

Trust: 0.8

sources: JVNDB: JVNDB-2019-016204

EXTERNAL IDS

db:NVDid:CVE-2019-20468

Trust: 2.7

db:JVNDBid:JVNDB-2019-016204

Trust: 0.8

db:CNNVDid:CNNVD-202102-012

Trust: 0.6

db:OTHERid:NONE

Trust: 0.1

db:VULMONid:CVE-2019-20468

Trust: 0.1

db:PACKETSTORMid:179817

Trust: 0.1

sources: OTHER: None // VULMON: CVE-2019-20468 // JVNDB: JVNDB-2019-016204 // PACKETSTORM: 179817 // CNNVD: CNNVD-202102-012 // NVD: CVE-2019-20468

REFERENCES

url:https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/

Trust: 2.5

url:https://www.tk-star.com

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2019-20468

Trust: 1.5

url:http://seclists.org/fulldisclosure/2024/jul/14

Trust: 1.0

url:https://cwe.mitre.org/data/definitions/276.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2019-20468 // JVNDB: JVNDB-2019-016204 // PACKETSTORM: 179817 // CNNVD: CNNVD-202102-012 // NVD: CVE-2019-20468

CREDITS

Willem Westerhof | Secura

Trust: 0.1

sources: OTHER: None

SOURCES

db:OTHERid: -
db:VULMONid:CVE-2019-20468
db:JVNDBid:JVNDB-2019-016204
db:PACKETSTORMid:179817
db:CNNVDid:CNNVD-202102-012
db:NVDid:CVE-2019-20468

LAST UPDATE DATE

2025-01-30T22:40:13.046000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2019-20468date:2021-02-05T00:00:00
db:JVNDBid:JVNDB-2019-016204date:2021-10-19T07:44:00
db:CNNVDid:CNNVD-202102-012date:2021-02-09T00:00:00
db:NVDid:CVE-2019-20468date:2024-11-21T04:38:33.347

SOURCES RELEASE DATE

db:OTHERid: - date:2024-07-26T13:11:06
db:VULMONid:CVE-2019-20468date:2021-02-01T00:00:00
db:JVNDBid:JVNDB-2019-016204date:2021-10-19T00:00:00
db:PACKETSTORMid:179817date:2024-07-30T12:35:43
db:CNNVDid:CNNVD-202102-012date:2021-02-01T00:00:00
db:NVDid:CVE-2019-20468date:2021-02-01T21:15:13.547