CVE-2019-15474: Medium severity mi cepheus firmware vulnerability
The Xiaomi Cepheus Android device with a build fingerprint of Xiaomi/cepheus/cepheus:9/PKQ1.181121.001/V10.2.6.0.PFAMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15474?
CVE-2019-15474 has a high severity due to its potential for unauthorized microphone access.
How do I fix CVE-2019-15474?
To fix CVE-2019-15474, update the affected app or firmware provided by Xiaomi.
What devices are affected by CVE-2019-15474?
CVE-2019-15474 specifically affects the Xiaomi Cepheus Android device with the specified build fingerprint.
What type of vulnerability is CVE-2019-15474?
CVE-2019-15474 is a security vulnerability related to unauthorized audio recording through a pre-installed app.
Is there a risk of data compromise with CVE-2019-15474?
Yes, CVE-2019-15474 presents a risk of privacy invasion by allowing unauthorized access to microphone audio.