Medium severity · published Mar 17, 2019
CVE-2019-7386
A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices
6.5
CVSS
3.7%
EPSS
No
On KEV
Description
A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. When a crafted web page is visited with the internal browser, the Gecko process crashes with a segfault. Successful exploitation could lead to the remote code execution on the device.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
84
8810 4g Firmware · Nokia
10.05 · source: NVD
KA
Kaios · Kaiostech
2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7386
Exploit
http://packetstormsecurity.com/files/151651/Nokia-8810-Denial-Of-Service.html
Exploit
http://seclists.org/fulldisclosure/2019/Feb/35
Not Applicable
http://www.breakthesec.com
Not Applicable
http://www.breakthesec.com/search/label/0day
developer.kaiostech.com
https://developer.kaiostech.com/bugzilla-reports/report_141873.html
developer.kaiostech.com
https://developer.kaiostech.com/bugzilla-reports/report_58204.html
More from Kaios
9.8
CVE-2023-33294
An issue was discovered in KaiOS 3.0 before 3.1
6.1
CVE-2019-14758
An issue was discovered in KaiOS 2.5 and 2.5.1
6.1
CVE-2019-14757
An issue was discovered in KaiOS 2.5 and 2.5.1
6.1
CVE-2019-14756
An issue was discovered in KaiOS 1.0, 2.5, and 2.5.12.5
5.3
CVE-2023-33293
An issue was discovered in KaiOS 3.0 and 3.1