CVE-2020-28055
High
Description
A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. An attacker, such as a malicious APK or local unprivileged user could perform fake system upgrades by writing to the /data/vendor/upgrage folder.
SeverityHigh
CVSS7.8
Exploit probability—
ProductTcl 32s330 Firmware
PublishedNov 10, 2020
First seenNov 10, 2020
How to fix
Update
- tcl 32s330_firmwarev8-r851t10-lf1v091 or later
- tcl 40s330_firmwarev8-r851t10-lf1v091 or later
- tcl 43s434_firmwarev8-r851t02-lf1v440 or later
- tcl 50s434_firmwarev8-r851t02-lf1v440 or later
- tcl 55s434_firmwarev8-r851t02-lf1v440 or later
- tcl 65s434_firmwarev8-r851t02-lf1v440 or later
- tcl 75s434_firmwarev8-r851t02-lf1v440 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tcl 32s330_firmware | v < v8-r851t10-lf1v091 | v8-r851t10-lf1v091 |
| tcl 40s330_firmware | v < v8-r851t10-lf1v091 | v8-r851t10-lf1v091 |
| tcl 43s434_firmware | v < v8-r851t02-lf1v440 | v8-r851t02-lf1v440 |
| tcl 50s434_firmware | v < v8-r851t02-lf1v440 | v8-r851t02-lf1v440 |
| tcl 55s434_firmware | v < v8-r851t02-lf1v440 | v8-r851t02-lf1v440 |
| tcl 65s434_firmware | v < v8-r851t02-lf1v440 | v8-r851t02-lf1v440 |
| tcl 75s434_firmware | v < v8-r851t02-lf1v440 | v8-r851t02-lf1v440 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.