CVE-2024-27350: Medium severity Amazon Fire OS vulnerability
Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB (Android Debug Bridge) connections. NOTE: some third parties dispute whether this has security relevance, because an ADB connection is only possible after the (non-default) ADB Debugging option is enabled, and after the initiator of that specific connection attempt has been approved via a full-screen prompt.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon Fire OSto a version that resolves this vulnerability.Fixed in 7.6.6.9 - Upgrade
Upgrade
Amazon Fire OSto a version that resolves this vulnerability.Fixed in 8.1.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27350?
CVE-2024-27350 has been rated as Medium severity due to potential security risks posed by local ADB connections.
How do I fix CVE-2024-27350?
To mitigate CVE-2024-27350, users should update their Amazon Fire OS to version 7.6.6.9 or above or 8.1.0.3 or above, which addresses the vulnerability.
What applications are affected by CVE-2024-27350?
CVE-2024-27350 affects Fire TV applications that utilize ADB connections on Amazon Fire OS versions prior to the specified updates.
Can CVE-2024-27350 be exploited remotely?
No, CVE-2024-27350 requires physical access or local network access to exploit the ADB functionality.
What is the impact of CVE-2024-27350 on users?
The impact of CVE-2024-27350 may include unauthorized access to the device’s data and apps if ADB Debugging is enabled without proper security measures.