Information disclosure in Sharp Corporation products - CVE-2020-5571

Vulnerability identifier: #VU27241

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-5571

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to information disclosure issue in multiple SHARP Android devices. A local attacker can trick a victim to install a malicious appllication and gain unauthorized access to sensitive information on the system.

AQUOS sense2 SH-M08
AQUOS SH-RM02
AQUOS mini SH-M03
AQUOS Keitai SH-N01
AQUOS L2 (UQ mobile/J:COM)
AQUOS sense plus SH-M07
AQUOS sense lite SH-M05
AQUOS SH-M02
AQUOS sense (UQ mobile)
AQUOS sense2 (UQ mobile)
AQUOS compact SH-M06

Install updates from vendor's website.

• https://jvn.jp/en/jp/JVN93064451/index.html
• http://k-tai.sharp.co.jp/support/info/info036.html

• Information disclosure in multiple SHARP Android devices