CVE-2024-12993

Location information exposure in Infinix Weather app

CVSS 4.8 MEDIUMEPSS 0.2%CWE-497

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.8EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

30 Dec 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An attacker can communicate with the provider and reveal the user’s location without any privileges. After multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affects all Infinix Mobile devices.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

Infinix Mobile · com.rlk.weathers

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://cert.pl/en/posts/2024/12/CVE-2024-12993/https://cert.pl/posts/2024/12/CVE-2024-12993/