Login Request a demo
High severity · published Mar 6, 2019
CVE-2019-9599
The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash) via many simultaneous sdctl/comm/lite_auth/ requests
7.5
CVSS
13.3%
EPSS
No
On KEV
Description
The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash) via many simultaneous sdctl/comm/lite_auth/ requests.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.3% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Airdroid · Airdroid
through 4.2.1.6 · source: NVD
Affected product
AI
Airdroid
Airdroid
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-9599
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-9599
Exploit
https://www.exploit-db.com/exploits/46337
Exploit
https://www.youtube.com/watch?v=0QDM224_6DM
More from Airdroid
–
CVE-2015-5661
The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application
–
CVE-2013-0134
Cross-site scripting (XSS) vulnerability in the web interface in AirDroid allows remote attackers to inject arbitrary web script or HTML via a crafted text message that is…
–
CVE-2012-3888
The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism by modifying a pass value within JSON data
–
CVE-2012-3887
AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmission" feature, which allows remote attackers to obtain…
–
CVE-2012-3886
AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by…