CVE-2018-5892: Infoleak
Published Jun 4, 2018
·Updated
The Touch Pal application can collect user behavior data without awareness by the user in Snapdragon Mobile and Snapdragon Wear.
Affected Software
109 affected components
Google Android
Qualcomm Mdm9206 Firmware
Qualcomm MDM9206
Qualcomm Mdm9607 Firmware
Qualcomm MDM9607
Qualcomm Mdm9650 Firmware
Qualcomm MDM9650
Qualcomm Msm8996au Firmware
Qualcomm MSM8996AU
Qualcomm Sd 210 Firmware
Qualcomm SD 210
Qualcomm Sd 212 Firmware
Qualcomm SD 212
Qualcomm Sd 205 Firmware
Qualcomm SD 205
Qualcomm Sd 425 Firmware
Qualcomm SD 425
Qualcomm Sd 427 Firmware
Qualcomm SD 427
Qualcomm Sd 430 Firmware
Qualcomm SD 430
Qualcomm Sd 435 Firmware
Qualcomm SD 435
Qualcomm Sd 450 Firmware
Qualcomm SD 450
Qualcomm Sd 615 Firmware
Qualcomm SD 615
Qualcomm Sd 616 Firmware
Qualcomm Sd 616
Qualcomm Sd 415 Firmware
Qualcomm SD 415
Qualcomm Sd 625 Firmware
Qualcomm SD 625
Qualcomm Sd 650 Firmware
Qualcomm SD 650
Qualcomm Sd 652 Firmware
Qualcomm Sd 652
Qualcomm Sd 810 Firmware
Qualcomm SD 810
Qualcomm Sd 820 Firmware
Qualcomm SD 820
Qualcomm Sd 835 Firmware
Qualcomm SD 835
Qualcomm Sd 845 Firmware
Qualcomm SD 845
Qualcomm Sdm630 Firmware
Qualcomm SDM630
Qualcomm Sdm636 Firmware
Qualcomm SDM636
Qualcomm Sdm660 Firmware
Qualcomm SDM660
Qualcomm Sdm710 Firmware
Qualcomm SDM710
Qualcomm Snapdragon High Med 2016 Firmware
Qualcomm Snapdragon High Med 2016
All of the following
Qualcomm Mdm9206 Firmware
Qualcomm MDM9206
All of the following
Qualcomm Mdm9607 Firmware
Qualcomm MDM9607
All of the following
Qualcomm Mdm9650 Firmware
Qualcomm MDM9650
All of the following
Qualcomm Msm8996au Firmware
Qualcomm MSM8996AU
All of the following
Qualcomm Sd 210 Firmware
Qualcomm SD 210
All of the following
Qualcomm Sd 212 Firmware
Qualcomm SD 212
All of the following
Qualcomm Sd 205 Firmware
Qualcomm SD 205
All of the following
Qualcomm Sd 425 Firmware
Qualcomm SD 425
All of the following
Qualcomm Sd 427 Firmware
Qualcomm SD 427
All of the following
Qualcomm Sd 430 Firmware
Qualcomm SD 430
All of the following
Qualcomm Sd 435 Firmware
Qualcomm SD 435
All of the following
Qualcomm Sd 450 Firmware
Qualcomm SD 450
All of the following
Qualcomm Sd 615 Firmware
Qualcomm SD 615
All of the following
Qualcomm Sd 616 Firmware
Qualcomm Sd 616
All of the following
Qualcomm Sd 415 Firmware
Qualcomm SD 415
All of the following
Qualcomm Sd 625 Firmware
Qualcomm SD 625
All of the following
Qualcomm Sd 650 Firmware
Qualcomm SD 650
All of the following
Qualcomm Sd 652 Firmware
Qualcomm Sd 652
All of the following
Qualcomm Sd 810 Firmware
Qualcomm SD 810
All of the following
Qualcomm Sd 820 Firmware
Qualcomm SD 820
All of the following
Qualcomm Sd 835 Firmware
Qualcomm SD 835
All of the following
Qualcomm Sd 845 Firmware
Qualcomm SD 845
All of the following
Qualcomm Sdm630 Firmware
Qualcomm SDM630
All of the following
Qualcomm Sdm636 Firmware
Qualcomm SDM636
All of the following
Qualcomm Sdm660 Firmware
Qualcomm SDM660
All of the following
Qualcomm Sdm710 Firmware
Qualcomm SDM710
All of the following
Qualcomm Snapdragon High Med 2016 Firmware
Qualcomm Snapdragon High Med 2016
Event History
Jun 4, 2018
CVE Published
via Android·12:00 AM
Jul 6, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionWeakness
Data Sourced
via NVD·05:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-5892?
CVE-2018-5892 is classified as a high-severity vulnerability due to its potential for extensive user data collection without consent.
2
How do I fix CVE-2018-5892?
To fix CVE-2018-5892, users should ensure their Snapdragon devices are updated with the latest firmware provided by Qualcomm.
3
What should users do if they are affected by CVE-2018-5892?
Affected users should monitor their device behavior and consider updating their applications, particularly Touch Pal, to mitigate risks.
4
Which devices are affected by CVE-2018-5892?
CVE-2018-5892 affects devices using Qualcomm's Snapdragon processors, including various models like the MDM9206, MDM9607, and others.
5
Is user awareness a factor in CVE-2018-5892?
Yes, CVE-2018-5892 specifically relates to the application collecting user behavior data without user awareness.