CVE-2019-6741: (Pwn2Own) Samsung Galaxy S9 Untrusted Site Redirection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must connect to a wireless network. The specific flaw exists within the captive portal. By manipulating HTML, an attacker can force a page redirection. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7476.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9. User interaction is required to exploit this vulnerability in that the target must connect to a wireless network. The specific flaw exists within the captive portal. By manipulating HTML, an attacker can force a page redirection. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-6741?
CVE-2019-6741 is a vulnerability that allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update.
How severe is CVE-2019-6741?
CVE-2019-6741 has a severity score of 9.3, which is classified as critical.
Is user interaction required to exploit CVE-2019-6741?
Yes, user interaction is required to exploit CVE-2019-6741 as the target must connect to a wireless network.
What software versions of Samsung Galaxy S9 are affected by CVE-2019-6741?
Vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467) are affected by CVE-2019-6741.
How can I fix CVE-2019-6741?
To fix CVE-2019-6741, update your Samsung Galaxy S9 to the January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467) or later versions.