Login Request a demo
High severity · published Oct 5, 2019
CVE-2019-17191
The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the audio channel may be open before the callee can block eavesdropping.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Private Messenger · Signal
before 4.47.7 · source: NVD
Affected product
PM
Private Messenger
Signal
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17191
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17191
Exploit
https://bugs.chromium.org/p/project-zero/issues/detail?id=1943
Exploit
https://news.ycombinator.com/item?id=21161432
Third Party Advisory
https://twitter.com/moxie/status/1180261210341511168
More from Private Messenger
9.8
CVE-2019-17192
The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which…
6.5
CVE-2019-9970
Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when…
5.3
CVE-2020-5753
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to…
4.7
CVE-2018-3988
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then…