CVE-2017-18648: Input Validation

Published Apr 7, 2020

Updated

An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) software. Arbitrary file read/write operations can occur in the locked state via a crafted MTP command. The Samsung ID is SVE-2017-10086 (November 2017).

Affected Software

17 affected components

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=4.4.4

Google Android=5.0

Google Android=5.0.1

Google Android=5.0.2

Google Android=5.1

Google Android=5.1.0

Google Android=5.1.1

Google Android=6.0

Google Android=6.0.1

Google Android=7.0

Google Android=7.1.0

Google Android=7.1.1

Google Android=7.1.2

Event History

Apr 7, 2020

CVE Published

via MITRE·03:56 PM

Data Sourced

via MITRE·03:56 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-18648?

CVE-2017-18648 is considered to have a medium severity due to the potential for unauthorized file access in locked state.

How do I fix CVE-2017-18648?

To address CVE-2017-18648, users should update their Samsung mobile devices to the latest software version that addresses this vulnerability.

What devices are affected by CVE-2017-18648?

CVE-2017-18648 affects Samsung devices running Android versions 4.4 through 7.1.2.

Can CVE-2017-18648 lead to data loss?

Yes, CVE-2017-18648 could potentially lead to unauthorized access or manipulation of files, resulting in data loss.

Is there a permanent fix for CVE-2017-18648?

Samsung has released security updates that permanently fix CVE-2017-18648, so users should install these updates.