Vulnerability Intelligence Report
CVE-2019-15027
The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arbitrary commands as root via shell metacharacters in a filename under /data, because clear_emmc_nomedia_entry in platform/mt6577/external/meta/emmc/meta_clr_emmc.c invokes 'system("/system/bin/rm -r /data/' followed by this filename upon an eMMC clearance from a Meta Mode boot. NOTE: compromise of Fire OS on the Amazon Echo Dot would require a second hypothetical vulnerability that allows creation of the required file under /data.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:3.18%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| mediatek | mt8163_firmware | all |
| mediatek | mt8163 | all |
| mediatek | mt6625_firmware | all |
| mediatek | mt6625 | all |
| mediatek | mt6577_firmware | all |
| mediatek | mt6577 | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
3.181%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2019-08-13T00:00:00 |
| Published | 2019-08-14T12:03:35 |
| Last Updated | 2024-08-05T00:34:53 |
Community Chatter & Buzz