7.5

CVE-2018-16270

Exploit
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Samsung ≫ Galaxy Gear Firmware Version < re2
   Samsung ≫ Galaxy Gear Version-
Samsung ≫ Gear 2 Firmware Version < re2
   Samsung ≫ Gear 2 Version-
Samsung ≫ Gear Live Firmware Version < re2
   Samsung ≫ Gear Live Version-
Samsung ≫ Gear S Firmware Version < re2
   Samsung ≫ Gear S Version-
Samsung ≫ Gear S2 Firmware Version < re2
   Samsung ≫ Gear S2 Version-
Samsung ≫ Gear S3 Firmware Version < re2
   Samsung ≫ Gear S3 Version-
Samsung ≫ Gear Sport Firmware Version < re2
   Samsung ≫ Gear Sport Version-
Samsung ≫ Gear Fit Firmware Version < re2
   Samsung ≫ Gear Fit Version-
Samsung ≫ Gear Fit 2 Firmware Version < re2
   Samsung ≫ Gear Fit 2 Version-
Samsung ≫ Gear Fit 2 Pro Firmware Version < re2
   Samsung ≫ Gear Fit 2 Pro Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.575
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.