CVE-2018-15482: Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents

Critical severity · published Aug 17, 2018

CVE-2018-15482

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents

9.8

CVSS

0.7%

EPSS

On KEV

Description

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID is LVE-SMP-180006.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 52% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Android · Google

6.0; 6.0.1; 7.0; 7.1; 7.2; 8.0; +1 more · source: NVD

Affected product

Android

Google

All Android CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-15482

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-15482

Third Party Advisory

https://lgsecurity.lge.com/security_updates.html

Third Party Advisory

https://www.kryptowire.com/portal/android-firmware-defcon-2018/