CVE-2017-18695: Medium severity android vulnerability

Published Apr 7, 2020

Updated

An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Attackers (who control a certain subdomain) can discover a user's credentials, during an email account login, via an EAS autodiscover packet. The Samsung ID is SVE-2016-7654 (January 2017).

Affected Software

5 affected components

Google Android=4.4

Google Android=5.0

Google Android=5.1

Google Android=6.0

Google Android=7.0

Event History

Apr 7, 2020

CVE Published

via MITRE·01:56 PM

Data Sourced

via MITRE·01:56 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-18695?

CVE-2017-18695 is categorized as a high-severity vulnerability affecting Samsung mobile devices.

How do I fix CVE-2017-18695?

To mitigate CVE-2017-18695, users should update their Samsung devices to the latest software version provided by Samsung.

What devices are affected by CVE-2017-18695?

CVE-2017-18695 impacts Samsung mobile devices running Android versions 4.4, 5.0, 5.1, 6.0, and 7.0.

What kind of attack is possible with CVE-2017-18695?

Attackers exploiting CVE-2017-18695 can capture user credentials during email account login through an EAS autodiscover packet.

When was CVE-2017-18695 disclosed?

CVE-2017-18695 was disclosed in January 2017, along with the Samsung ID SVE-2016-7654.