First published: Thu Nov 14 2019(Updated: )
The Samsung S7 Android device with a build fingerprint of samsung/heroltexx/herolte:8.0.0/R16NW/G930FXXS4ESC3:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app (versionCode=7000000, versionName=7.0.0.0) that allows other pre-installed apps to perform app installation via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Samsung Galaxy S7 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2019-15444 is rated as a high-severity vulnerability due to the potential for unauthorized access by other pre-installed apps.
To address CVE-2019-15444, ensure that your Samsung Galaxy S7 device is updated to the latest firmware version provided by Samsung.
CVE-2019-15444 specifically affects the Samsung Galaxy S7 running the Android 8.0.0 firmware.
The primary risk of CVE-2019-15444 is that malicious pre-installed applications could exploit the vulnerability to gain unauthorized access to sensitive user data.
As of the last reports, there is no evidence that CVE-2019-15444 is actively exploited in the wild, but users should remain vigilant.