NetSight
IP …
high7.5

CVE-2018-16270

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction.

Impact

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.

Affected products

VendorProductAffected versions
SamsungGalaxy Gear Firmware
before re2
SamsungGear 2 Firmware
before re2
SamsungGear Live Firmware
before re2
SamsungGear S Firmware
before re2
SamsungGear S2 Firmware
before re2
SamsungGear S3 Firmware
before re2
SamsungGear Sport Firmware
before re2
SamsungGear Fit Firmware
before re2
SamsungGear Fit 2 Firmware
before re2
SamsungGear Fit 2 Pro Firmware
before re2

Weakness classification

CWE-269

References