cve-2019-16401
Vulnerability from cvelistv5
Published
2019-11-06 22:14
Modified
2024-08-05 01:17
Severity ?
Summary
Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status.
References
cve@mitre.orghttps://www.openconf.org/acsac2019/modules/request.php?module=oc_program&action=summary.php&id=210Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.openconf.org/acsac2019/modules/request.php?module=oc_program&action=summary.php&id=210Third Party Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:17:39.516Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openconf.org/acsac2019/modules/request.php?module=oc_program\u0026action=summary.php\u0026id=210"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-11-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-06T22:14:04",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openconf.org/acsac2019/modules/request.php?module=oc_program\u0026action=summary.php\u0026id=210"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-16401",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.openconf.org/acsac2019/modules/request.php?module=oc_program\u0026action=summary.php\u0026id=210",
              "refsource": "MISC",
              "url": "https://www.openconf.org/acsac2019/modules/request.php?module=oc_program\u0026action=summary.php\u0026id=210"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-16401",
    "datePublished": "2019-11-06T22:14:04",
    "dateReserved": "2019-09-18T00:00:00",
    "dateUpdated": "2024-08-05T01:17:39.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:samsung:galaxy_s8_plus_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"357006C1-11B3-49D2-A8DE-03DF52501DC9\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:samsung:galaxy_s8_plus:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"71B1548A-DF80-4530-8B0E-0B83D414AAD6\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:samsung:galaxy_s3_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E17ACF33-BA4B-4FD4-811F-4AD860C016E7\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:samsung:galaxy_s3:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A294254-1687-4340-BF07-06373FBFC072\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:samsung:galaxy_note_2_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9ABF64AC-AA4A-4108-86AF-C976CC2530EC\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:samsung:galaxy_note_2:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11A19CD-FAFE-45ED-A24C-72642C3ED565\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status.\"}, {\"lang\": \"es\", \"value\": \"Los dispositivos Samsung Galaxy S8 plus (versi\\u00f3n de Android: 8.0.0, N\\u00famero de Compilaci\\u00f3n: R16NW.G955USQU5CRG3, Suplidor de Banda Base: Qualcomm Snapdragon 835, Banda Base: G955USQU5CRG3), Samsung Galaxy S3 (versi\\u00f3n de Android: 4.3, N\\u00famero de Compilaci\\u00f3n: JSS15J.I9300XXUGND5, Suplidor de Banda Base: Samsung Exynos 4412, Banda Base: I9300XXUGNA8) y Samsung Galaxy Note 2 (versi\\u00f3n de Android: 4.3, N\\u00famero de Compilaci\\u00f3n: JSS15J.I9300XUGND5, Suplidor de Banda Base: Samsung Exynos 4412, Banda Base: N7100DDUFND1), permiten la inyecci\\u00f3n de AT+CIMI y AT+CGSN mediante Bluetooth, una filtrado de informaci\\u00f3n confidencial, como IMSI, IMEI, estado de la llamada, etapa de configuraci\\u00f3n de la llamada, estado del servicio de Internet, intensidad de la se\\u00f1al, estado de roaming actual, nivel de bater\\u00eda y estado de llamada retenida.\"}]",
      "id": "CVE-2019-16401",
      "lastModified": "2024-11-21T04:30:38.557",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:A/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 3.3, \"accessVector\": \"ADJACENT_NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.5, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-11-06T23:15:10.463",
      "references": "[{\"url\": \"https://www.openconf.org/acsac2019/modules/request.php?module=oc_program\u0026action=summary.php\u0026id=210\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.openconf.org/acsac2019/modules/request.php?module=oc_program\u0026action=summary.php\u0026id=210\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-16401\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-11-06T23:15:10.463\",\"lastModified\":\"2024-11-21T04:30:38.557\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status.\"},{\"lang\":\"es\",\"value\":\"Los dispositivos Samsung Galaxy S8 plus (versi\u00f3n de Android: 8.0.0, N\u00famero de Compilaci\u00f3n: R16NW.G955USQU5CRG3, Suplidor de Banda Base: Qualcomm Snapdragon 835, Banda Base: G955USQU5CRG3), Samsung Galaxy S3 (versi\u00f3n de Android: 4.3, N\u00famero de Compilaci\u00f3n: JSS15J.I9300XXUGND5, Suplidor de Banda Base: Samsung Exynos 4412, Banda Base: I9300XXUGNA8) y Samsung Galaxy Note 2 (versi\u00f3n de Android: 4.3, N\u00famero de Compilaci\u00f3n: JSS15J.I9300XUGND5, Suplidor de Banda Base: Samsung Exynos 4412, Banda Base: N7100DDUFND1), permiten la inyecci\u00f3n de AT+CIMI y AT+CGSN mediante Bluetooth, una filtrado de informaci\u00f3n confidencial, como IMSI, IMEI, estado de la llamada, etapa de configuraci\u00f3n de la llamada, estado del servicio de Internet, intensidad de la se\u00f1al, estado de roaming actual, nivel de bater\u00eda y estado de llamada retenida.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:A/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":3.3,\"accessVector\":\"ADJACENT_NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.5,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:samsung:galaxy_s8_plus_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"357006C1-11B3-49D2-A8DE-03DF52501DC9\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:samsung:galaxy_s8_plus:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71B1548A-DF80-4530-8B0E-0B83D414AAD6\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:samsung:galaxy_s3_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E17ACF33-BA4B-4FD4-811F-4AD860C016E7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:samsung:galaxy_s3:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A294254-1687-4340-BF07-06373FBFC072\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:samsung:galaxy_note_2_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9ABF64AC-AA4A-4108-86AF-C976CC2530EC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:samsung:galaxy_note_2:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11A19CD-FAFE-45ED-A24C-72642C3ED565\"}]}]}],\"references\":[{\"url\":\"https://www.openconf.org/acsac2019/modules/request.php?module=oc_program\u0026action=summary.php\u0026id=210\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.openconf.org/acsac2019/modules/request.php?module=oc_program\u0026action=summary.php\u0026id=210\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.