CVE-2019-15438: High severity samsung xcover 4 firmware vulnerability
The Samsung XCover4 Android device with a build fingerprint of samsung/xcover4ltedo/xcover4lte:8.1.0/M1AJQ/G390YDXU2BSA1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app (versionCode=7000100, versionName=7.0.1.0) that allows other pre-installed apps to perform app installation via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15438?
CVE-2019-15438 is classified as a moderate severity vulnerability due to its potential to allow unauthorized access to sensitive data.
How do I fix CVE-2019-15438?
To fix CVE-2019-15438, ensure that you update the affected Samsung XCover4 device to the latest firmware version provided by the manufacturer.
What devices are affected by CVE-2019-15438?
CVE-2019-15438 specifically affects the Samsung XCover4 Android device with the specified build fingerprint and the pre-installed Theme Center application.
What are the potential impacts of CVE-2019-15438?
The potential impacts of CVE-2019-15438 include unauthorized access to device functionalities and potential data leakage through the exploited application.
Is there a workaround for CVE-2019-15438 if I cannot update my device?
A possible workaround for CVE-2019-15438 is to uninstall or disable the vulnerable pre-installed application if the option is available.