wonder rc555l firmware 漏洞

CVE编号

CVE-2018-6598

利用情况

暂无

补丁情况

N/A

披露时间

2018-08-30

漏洞描述

An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. Any app co-located on the device can send an intent to factory reset the device programmatically because of com.android.server.MasterClearReceiver. This does not require any user interaction and does not require any permission to perform. A factory reset will remove all user data from the device. This will result in the loss of any data that the user has not backed up or synced externally. This capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves), although this capability is present in an unprotected component of the Android OS. This vulnerability is not present in Google's Android Open Source Project (AOSP) code. Therefore, it was introduced by Orbic or another entity in the supply chain.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://www.kryptowire.com/portal/android-firmware-defcon-2018/

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	系统	orbic	wonder_rc555l_firmware	7.1.2	-
	运行在以下环境
	硬件	orbic	wonder_rc555l	-	-

CVSS3评分 7.1

• 攻击路径 本地
• 攻击复杂度 低
• 权限要求 低
• 影响范围 未更改
• 用户交互 无
• 可用性 高
• 保密性 无
• 完整性 高

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CWE-ID 漏洞类型 CWE-732 关键资源的不正确权限授予 NVD-CWE-noinfo