Most recent entries from all

cnvd-2017-05072

fkie_cve-2016-10137

GHSA-pc2g-6rqh-gjv7

gsd-2016-10137

VAR-201701-0482

An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so. Adups Fota is a professional wireless upgrade solution provided by Shanghai Guangsheng Information Technology Co., Ltd. (Adups) for IoT devices (smart cars, wearables, homes, VR, etc.). Adups has a local privilege elevation vulnerability. Attackers can use vulnerabilities to obtain privilege information and elevate permissions. Local attackers can exploit this issue to gain elevated privileges