7.5

CVE-2018-16270

Exploit
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Samsung ≫ Galaxy Gear Firmware Version < re2
   Samsung ≫ Galaxy Gear Version -
Samsung ≫ Gear 2 Firmware Version < re2
   Samsung ≫ Gear 2 Version -
Samsung ≫ Gear Live Firmware Version < re2
   Samsung ≫ Gear Live Version -
Samsung ≫ Gear S Firmware Version < re2
   Samsung ≫ Gear S Version -
Samsung ≫ Gear S2 Firmware Version < re2
   Samsung ≫ Gear S2 Version -
Samsung ≫ Gear S3 Firmware Version < re2
   Samsung ≫ Gear S3 Version -
Samsung ≫ Gear Sport Firmware Version < re2
   Samsung ≫ Gear Sport Version -
Samsung ≫ Gear Fit Firmware Version < re2
   Samsung ≫ Gear Fit Version -
Samsung ≫ Gear Fit 2 Firmware Version < re2
   Samsung ≫ Gear Fit 2 Version -
Samsung ≫ Gear Fit 2 Pro Firmware Version < re2
   Samsung ≫ Gear Fit 2 Pro Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.16% 0.63
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf
Third Party Advisory
Exploit
https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
Third Party Advisory
Exploit