CVE-2018-16270
High
Description
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Samsung Galaxy Gear Firmware
PublishedJan 22, 2020
First seenJan 22, 2020
How to fix
Update
- samsung galaxy_gear_firmwarere2 or later
- samsung gear_2_firmwarere2 or later
- samsung gear_live_firmwarere2 or later
- samsung gear_s_firmwarere2 or later
- samsung gear_s2_firmwarere2 or later
- samsung gear_s3_firmwarere2 or later
- samsung gear_sport_firmwarere2 or later
- samsung gear_fit_firmwarere2 or later
- samsung gear_fit_2_firmwarere2 or later
- samsung gear_fit_2_pro_firmwarere2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samsung galaxy_gear_firmware | v < re2 | re2 |
| samsung gear_2_firmware | v < re2 | re2 |
| samsung gear_live_firmware | v < re2 | re2 |
| samsung gear_s_firmware | v < re2 | re2 |
| samsung gear_s2_firmware | v < re2 | re2 |
| samsung gear_s3_firmware | v < re2 | re2 |
| samsung gear_sport_firmware | v < re2 | re2 |
| samsung gear_fit_firmware | v < re2 | re2 |
| samsung gear_fit_2_firmware | v < re2 | re2 |
| samsung gear_fit_2_pro_firmware | v < re2 | re2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.