CVE-2018-16270

CWE-269 — Improper Privilege Management3 documents3 sources

Severity

7.5HIGH

EPSS

0.4%

top 41.81%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Samsung Galaxy Gear Firmware Samsung Gear 2 Firmware Samsung Gear FIT 2 Firmware +7 more

Timeline

PublishedJan 22

Latest updateMay 24

Description

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages10 packages

▶NVDsamsung/galaxy_gear_firmware< re2

▶NVDsamsung/gear_2_firmware< re2

▶NVDsamsung/gear_s_firmware< re2

▶NVDsamsung/gear_s2_firmware< re2

▶NVDsamsung/gear_s3_firmware< re2

🔴Vulnerability Details

GHSA

GHSA-fwf5-32xc-rx62: Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction↗2022-05-24

▶

CVEList

CVE-2018-16270: Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction↗2020-01-22

▶