Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package name of com.qualcomm.qti.modemtestmode (versionCode=24, versionName=7.0) that contains an exported service app component named com.qualcomm.qti.modemtestmode.MbnTestService that allows any app on the device to set certain system properties as the com.android.phone user. When an app sets the persist.service.logr.enable system property to a value of 1, an app with a package name of com.yulong.logredirect (versionCode=20160622, versionName=5.25_20160622_01) will start writing the system-wide logcat log, kernel log, and a tcpdump network traffic capture to external storage. Furthermore, on the Coolpad Canvas device, the com.android.phone app writes the destination phone number and body of the text message for outgoing text messages. A notification when logging can be avoided if the log is enabled after device startup and disabled prior to device shutdown by setting the system properties using the exported interface of the com.qualcomm.qti.modemtestmode app. Any app with the READ_EXTERNAL_STORAGE permission can access the log files.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Coolpad Canvas 安全漏洞
Vulnerability Description
Coolpad Canvas是中国酷派（Coolpad）集团公司的一款基于Android平台的智能手机。 Coolpad Canvas（所使用的Build fingerprint为Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys）中的平台应用程序的com.qualcomm.qti.modemtestmode数据包的com.qualcomm.qti.modemtestmode.MbnTestService应用程序组件存在安全漏洞。攻
CVSS Information
N/A
Vulnerability Type
N/A