CVE-2022-20060 - In preloader (usb), there is a possible permission bypass due to a missing proper image authentication

Back Back to CVE browser

MEDIUM

In preloader (usb), there is a possible permission bypass due to a missing proper image authentication

Published Mar 9, 2022

6.6

MEDIUM

CVSS 3.1

EPSS 0.14%

Description

In preloader (usb), there is a possible permission bypass due to a missing proper image authentication. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06137462.

Affected products

Vendor MediaTek, Inc. Product n/a Default
n/a
- Version
  Android 10.0, 11.0, 12.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MediaTek, Inc.

n/a

Version	Status	Constraints
Android 10.0, 11.0, 12.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (2)

https://corp.mediatek.com/product-security-bulletin/March-2022
x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-25320
Advisory

Link	Providers	Tags
https://corp.mediatek.com/product-security-bulletin/March-2022		x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-25320		Advisory