CVE-2019-15358 : Security Advisory and Response

The Dexp Z250 Android device is vulnerable to unauthorized system property modification due to a pre-installed app.

Understanding CVE-2019-15358

The vulnerability allows any co-located app to alter system properties without proper authorization.

What is CVE-2019-15358?

The Dexp Z250 Android device with a specific build fingerprint contains an app that permits unauthorized modification of system properties by other apps on the device.

The Impact of CVE-2019-15358

Unauthorized access to system properties can lead to security breaches and data manipulation.
Malicious apps can exploit this vulnerability to perform unauthorized actions on the device.

Technical Details of CVE-2019-15358

The vulnerability details and affected systems.

Vulnerability Description

The Dexp Z250 Android device's pre-installed app allows unauthorized alteration of system properties by any co-located app.

Affected Systems and Versions

Device: Dexp Z250 Android
App: com.mediatek.wfo.impl
Version: 8.1.0

Exploitation Mechanism

The vulnerability is exploited through an exported interface in the com.mediatek.wfo.impl app.

Mitigation and Prevention

Steps to mitigate and prevent exploitation of CVE-2019-15358.

Immediate Steps to Take

Disable or uninstall the com.mediatek.wfo.impl app.
Regularly monitor app permissions and system changes.

Long-Term Security Practices

Keep the device updated with the latest security patches.
Avoid installing apps from untrusted sources.

Patching and Updates

Check for security updates from the device manufacturer and apply them promptly.