LG Mobile Device up to 9.0 Connectivity Service injection

Summaryinfo

A vulnerability was found in LG Mobile Device up to 9.0. It has been declared as critical. Affected by this issue is some unknown functionality of the component Connectivity Service. Such manipulation leads to injection. This vulnerability is traded as CVE-2019-20773. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in LG Mobile Device up to 9.0 (Smartphone Operating System). It has been rated as critical. Affected by this issue is some unknown processing of the component Connectivity Service. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. Unprivileged applications can execute shell commands via the connectivity service. The LG ID is LVE-SMP-190008 (August 2019).

The weakness was shared 04/17/2020 (Website). The advisory is available at lgsecurity.lge.com. This vulnerability is handled as CVE-2019-20773 since 04/17/2020. The exploitation is known to be easy. Local access is required to approach this attack. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/18/2020). This vulnerability is assigned to T1055 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-154030, VDB-154031, VDB-154032 and VDB-154033 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• LG

Name

• Mobile Device

Version

• 7.0
• 7.1
• 7.2
• 8.0
• 8.1
• 9.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion