Sign-up

ID

VAR-201904-0540


CVE

CVE-2018-11958


TITLE

plural Snapdragon Access control vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-015203

DESCRIPTION

Insufficient protection of keys in keypad can lead HLOS to gain access to confidential keypad input data in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9206, MDM9607, MDM9650, MDM9655, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016. plural Snapdragon The product contains an access control vulnerability.Information may be obtained. QualcommMDM9607 and others are a central processing unit (CPU) product of Qualcomm. There are access control error vulnerabilities in ContentProtection in several Qualcomm products. An attacker could exploit this vulnerability to gain access to sensitive keypad input data. The following products are affected: Qualcomm MDM9206; MDM9607; MDM9650; MDM9655; Qualcomm 215; SD 210; SD 212; SD 205; SD 410/12; SD 425; SD 427; SD 615/16; SD 415; SD 625; SD 632; SD 636; SD 650/52; SDA660; SDM439; SDM630; SDM660; Snapdragon_High_Med_2016

Trust: 2.34

sources: NVD: CVE-2018-11958 // JVNDB: JVNDB-2018-015203 // CNVD: CNVD-2019-08981 // VULHUB: VHN-121869 // VULMON: CVE-2018-11958

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-08981

AFFECTED PRODUCTS

vendor:qualcommmodel:mdm9206scope: - version: -

Trust: 1.4

vendor:qualcommmodel:mdm9607scope: - version: -

Trust: 1.4

vendor:qualcommmodel:mdm9650scope: - version: -

Trust: 1.4

vendor:qualcommmodel:mdm9655scope: - version: -

Trust: 1.4

vendor:qualcommmodel:sd 632scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 415scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 205scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 427scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 212scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 650scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 636scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sda660scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 652scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 425scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 429scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:mdm9607scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:snapdragon high med 2016scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 615scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:mdm9650scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:mdm9206scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sdm630scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sdm660scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:qm215scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 450scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:mdm9655scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 616scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sdm439scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 439scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 435scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 412scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 430scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 210scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 410scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 625scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:215scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 205scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 210scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 212scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 410scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 412scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sdscope:eqversion:210

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:212

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:205

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:425

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:450

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:615/16

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:415

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:625

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:650/52

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:430

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:410/12

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:427

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:435

Trust: 0.6

vendor:qualcommmodel:sdm630scope: - version: -

Trust: 0.6

vendor:qualcommmodel:snapdragon high med 2016scope: - version: -

Trust: 0.6

vendor:qualcommmodel:sda660scope: - version: -

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:632

Trust: 0.6

vendor:qualcommmodel:sdm439scope: - version: -

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:439

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:429

Trust: 0.6

vendor:qualcommmodel:sdscope:eqversion:636

Trust: 0.6

vendor:qualcommmodel:qualcommscope:eqversion:215

Trust: 0.6

sources: CNVD: CNVD-2019-08981 // JVNDB: JVNDB-2018-015203 // NVD: CVE-2018-11958

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-11958
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-11958
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2019-08981
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201903-137
value: MEDIUM

Trust: 0.6

VULHUB: VHN-121869
value: MEDIUM

Trust: 0.1

VULMON: CVE-2018-11958
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-11958
severity: MEDIUM
baseScore: 4.9
vectorString: AV:L/AC:L/AU:N/C:C/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2019-08981
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-121869
severity: MEDIUM
baseScore: 4.9
vectorString: AV:L/AC:L/AU:N/C:C/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-11958
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2019-08981 // VULHUB: VHN-121869 // VULMON: CVE-2018-11958 // JVNDB: JVNDB-2018-015203 // CNNVD: CNNVD-201903-137 // NVD: CVE-2018-11958

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-284

Trust: 0.9

sources: VULHUB: VHN-121869 // JVNDB: JVNDB-2018-015203 // NVD: CVE-2018-11958

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201903-137

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201903-137

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-015203

PATCH
title:March 2019 Qualcomm Technologies, Inc. Security Bulletinurl:https://www.qualcomm.com/company/product-security/bulletins
Trust: 0.8
title:Patches for multiple Qualcomm product access control error vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/158071
Trust: 0.6
title:Multiple Qualcomm Product access control error vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=89806
Trust: 0.6
title:Android Security Bulletins: Android Security Bulletin — March 2019url:https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins&qid=e9cddeba5732c8294d7cd6c4b6f1170b
Trust: 0.1
title:Threatposturl:https://threatpost.com/google-critical-bluetooth-rce/142685/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-08981 // 
            
            
            
            VULMON: CVE-2018-11958 // 
            
            
            
            JVNDB: JVNDB-2018-015203 // 
            
            
            
            CNNVD: CNNVD-201903-137

EXTERNAL IDS
db:NVDid:CVE-2018-11958
Trust: 3.2
db:JVNDBid:JVNDB-2018-015203
Trust: 0.8
db:CNNVDid:CNNVD-201903-137
Trust: 0.7
db:CNVDid:CNVD-2019-08981
Trust: 0.6
db:VULHUBid:VHN-121869
Trust: 0.1
db:VULMONid:CVE-2018-11958
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-08981 // 
            
            
            
            VULHUB: VHN-121869 // 
            
            
            
            VULMON: CVE-2018-11958 // 
            
            
            
            JVNDB: JVNDB-2018-015203 // 
            
            
            
            CNNVD: CNNVD-201903-137 // 
            
            
            
            NVD: CVE-2018-11958

REFERENCES
url:https://www.qualcomm.com/company/product-security/bulletins
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-11958
Trust: 1.4
url:https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-march-2019-28664
Trust: 1.2
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-11958
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://source.android.com/security/bulletin/2019-03-01.html
Trust: 0.1
url:https://threatpost.com/google-critical-bluetooth-rce/142685/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-08981 // 
            
            
            
            VULHUB: VHN-121869 // 
            
            
            
            VULMON: CVE-2018-11958 // 
            
            
            
            JVNDB: JVNDB-2018-015203 // 
            
            
            
            CNNVD: CNNVD-201903-137 // 
            
            
            
            NVD: CVE-2018-11958

SOURCES
db:CNVDid:CNVD-2019-08981
db:VULHUBid:VHN-121869
db:VULMONid:CVE-2018-11958
db:JVNDBid:JVNDB-2018-015203
db:CNNVDid:CNNVD-201903-137
db:NVDid:CVE-2018-11958

LAST UPDATE DATE
2024-11-23T21:37:13.356000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-08981date:2019-04-03T00:00:00
db:VULHUBid:VHN-121869date:2019-10-03T00:00:00
db:VULMONid:CVE-2018-11958date:2019-10-03T00:00:00
db:JVNDBid:JVNDB-2018-015203date:2019-05-13T00:00:00
db:CNNVDid:CNNVD-201903-137date:2019-10-23T00:00:00
db:NVDid:CVE-2018-11958date:2024-11-21T03:44:19.653

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-08981date:2019-04-03T00:00:00
db:VULHUBid:VHN-121869date:2019-04-04T00:00:00
db:VULMONid:CVE-2018-11958date:2019-04-04T00:00:00
db:JVNDBid:JVNDB-2018-015203date:2019-05-13T00:00:00
db:CNNVDid:CNNVD-201903-137date:2019-03-05T00:00:00
db:NVDid:CVE-2018-11958date:2019-04-04T15:29:00.530