Vulnerability Details : CVE-2011-4872
Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.
Vulnerability category: Information leak
Products affected by CVE-2011-4872
- cpe:2.3:h:htc:evo_3d:gri40:*:*:*:*:*:*:*
- cpe:2.3:h:htc:evo_4g:gri40:*:*:*:*:*:*:*
- cpe:2.3:h:htc:desire_hd:frg83d:*:*:*:*:*:*:*
- cpe:2.3:h:htc:desire_hd:gri40:*:*:*:*:*:*:*
- cpe:2.3:h:htc:glacier:frg83:*:*:*:*:*:*:*
- cpe:2.3:h:htc:droid_incredible:frf91:*:*:*:*:*:*:*
- cpe:2.3:h:htc:thunderbolt_4g:frg83d:*:*:*:*:*:*:*
- cpe:2.3:h:htc:sensation_4g:gri40:*:*:*:*:*:*:*
- cpe:2.3:h:htc:desire_s:gri40:*:*:*:*:*:*:*
- cpe:2.3:h:htc:sensation_z710e:gri40:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-4872
0.50%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-4872
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.6
|
LOW | AV:N/AC:H/Au:N/C:P/I:N/A:N |
4.9
|
2.9
|
NIST |
CWE ids for CVE-2011-4872
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-4872
-
http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html
My War with Entropy: 802.1X password exploit on many HTC Android devices
-
http://www.securityfocus.com/bid/51790
Multiple HTC Devices 'Android.permission.ACCESS_WIFI_STATE' Information Disclosure Vulnerability
-
http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html
-
http://www.kb.cert.org/vuls/id/763355
VU#763355 - 802.1X password exploit on many HTC Android devicesUS Government Resource
Jump to