Vulnerability · Published Nov 10, 2020 · Assigned by Vivo
CVE-2020-12485
Medium 5.5
In plain English
A medium-severity out-of-bounds read in The frame touch module from vivo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 81.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The frame touch module does not make validity judgments on parameter lengths when processing specific parameters,which caused out of the boundary when memory access.The vulnerability eventually leads to a local DOS on the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vivo | The frame touch module | unspecified – before PD2012_1.4.0unspecified – before PD1965EF_EX_EU_4.4.0unspecified – before PD2001F_EX_1.6.0unspecified – before PD1968F_EX_1.10.1unspecified – before PD1962_1.7.6unspecified – before PD1981_1.5.0unspecified – before PD2006F_EX_1.6.2 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://www.vivo.com/en/support/security-advisory-detail?id=2 x_refsource_CONFIRM