CVE-2019-15472: mi a2_lite_firmware

Vulnerability summary

CVE-2019-15472 is a medium (CVSS 5.5) vulnerability in mi a2_lite_firmware. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.6% of scored vulnerabilities.

Timeline

1. 14-11-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy_sprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.

• CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.