Security restrictions bypass in Unisoc chipsets
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2024-39441 |
| CWE-ID | CWE-200 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
T310 Mobile applications / Mobile firmware & hardware T606 Mobile applications / Mobile firmware & hardware T612 Mobile applications / Mobile firmware & hardware T616 Mobile applications / Mobile firmware & hardware T610 Mobile applications / Mobile firmware & hardware T618 Mobile applications / Mobile firmware & hardware T750 Mobile applications / Mobile firmware & hardware T765 Mobile applications / Mobile firmware & hardware T760 Mobile applications / Mobile firmware & hardware T770 Mobile applications / Mobile firmware & hardware T820 Mobile applications / Mobile firmware & hardware S8000 Mobile applications / Mobile firmware & hardware |
| Vendor | UNISOC |
Security Bulletin
This security bulletin contains one high risk vulnerability.
1) Information exposure
EUVDB-ID: #VU105228
Risk: High
CVSSv4.0: 6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-39441
CWE-ID:
CWE-200 - Exposure of sensitive information to an unauthorized actor
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to read and manipulate data.
The vulnerability exists due to a possible missing permission check within the wifi display in Android. A remote attacker can trick the victim to open a specially crafted file and read and manipulate data.
MitigationInstall security update from vendor's website.
Vulnerable software versionsT310: All versions
T606: All versions
T612: All versions
T616: All versions
T610: All versions
T618: All versions
T750: All versions
T765: All versions
T760: All versions
T770: All versions
T820: All versions
S8000: All versions
CPE2.3- cpe:2.3:a:unisoc:t310:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t606:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t612:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t616:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t610:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t618:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t750:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t765:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t760:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t770:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:t820:*:*:*:*:*:*:*:*
- cpe:2.3:a:unisoc:s8000:*:*:*:*:*:*:*:*
https://www.unisoc.com/en_us/secy/announcementDetail/1894203086612791298
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
