Unscored severity · published Jan 2, 2009
CVE-2008-5825
The SmartPoster implementation on the Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware does not properly display the URI record when the Title record contains a…
–
CVSS
1.6%
EPSS
No
On KEV
Description
The SmartPoster implementation on the Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware does not properly display the URI record when the Title record contains a certain combination of space, CR (aka \r), and . (dot) characters, which allows remote attackers to trick a user into loading an arbitrary URI via a crafted NDEF tag, as demonstrated by (1) an http: URI for a malicious web site, (2) a tel: URI for a premium-rate telephone number, and (3) an sms: URI that triggers purchase of a ringtone.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
6N
6131 Nfc · Nokia
05.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5825
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5825
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2008-08/0186.html
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2008-08/0344.html
events.ccc.de
http://events.ccc.de/congress/2008/Fahrplan/attachments/1109_collin_mulliner_eusecwest08_attacking_nfc_phones_slim.pdf
events.ccc.de
http://events.ccc.de/congress/2008/Fahrplan/events/2639.en.html
www.mulliner.org
http://www.mulliner.org/nfc/feed/collin_mulliner_25c3_attacking_nfc_phones.pdf
www.mulliner.org
http://www.mulliner.org/nfc/feed/collin_mulliner_eusecwest08_attacking_nfc_phones.pdf
More from 6131 Nfc
–
CVE-2008-5827
The Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware automatically installs software upon completing the download of a JAR file, which makes it easier for…
–
CVE-2008-5826
The Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware allows remote attackers to cause a denial of service (device crash) via (1) a large value in the payload…