Login Request a demo
Unscored severity · published Aug 18, 2014
CVE-2014-2388
The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which…
–
CVSS
1.2%
EPSS
No
On KEV
Description
The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which allows context-dependent attackers to read arbitrary files via (1) a session over a Wi-Fi network or (2) a session over a USB connection in Development Mode.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Blackberry OS · Blackberry
through 10.1.0.2354 · source: NVD
Q1
Q10 · Blackberry
All versions, or not specified · source: NVD
Q5
Q5 · Blackberry
All versions, or not specified · source: NVD
Z1
Z10 · Blackberry
All versions, or not specified · source: NVD
Z3
Z30 · Blackberry
All versions, or not specified · source: NVD
Affected product
BO
Blackberry OS
Blackberry
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2388
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2388
Exploit
http://packetstormsecurity.com/files/127850
packetstormsecurity.com
http://packetstormsecurity.com/files/127850/BlackBerry-Z10-Authentication-Bypass.html
secunia.com
http://secunia.com/advisories/60156
Vendor Advisory
http://www.blackberry.com/btsc/KB36174
Exploit
http://www.modzero.ch/advisories/MZ-13-04-Blackberry_Z10-File-Exchange-Authentication-By-Pass.txt
www.securityfocus.com
http://www.securityfocus.com/archive/1/533118/100/0/threaded
More from Blackberry OS
–
CVE-2014-6611
The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly…
–
CVE-2014-2389
Stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0.2312, when developer-mode has been previously enabled,…
–
CVE-2013-3692
BlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a BlackBerry Protect object, which allows physically proximate attackers to bypass…