8.8
CVSSv3

CVE-2019-2177

Published: 05/09/2019 Updated: 06/09/2019
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion due to a permissions bypass. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

google android 7.1.1

google android 7.1.2

google android 8.0

google android 8.1

google android 9.0

Recent Articles

Too bad, so sad, exploit devs: Google patches possibly several million dollars' worth of security flaws in Android
The Register • Shaun Nichols in San Francisco • 05 Sep 2019

Except one – a 'your phone is now my phone' bug reported months ago and still not fixed Fancy buying a compact and bijou cardboard box home in a San Francisco alley? This $2.5m Android bounty will get you nearly there

Google this week emitted the September edition of its monthly Android security updates – and has left at least one known vulnerability unpatched. Also, in case you missed it, the web giant started rolling out Android 10 a few days ago. The September 2019 bundle of security fixes will be pushed out automatically to Google-branded devices, while those with other Android gear will be fed the fixes by their device manufacturer or mobile carrier. Some of the holes can be patched remotely by the ad ...