CVE-2024-36842 PoC — Allwinner TS17 Android Infotainment System 安全漏洞

Description

CVE-2024-36842, Creating Persistent Backdoor on Oncord+ android/ios car infotaiment using malicious script!

介绍

**# CVE-2024-36842 Backdooring-Oncord+ Android-Sterio**
We have conducted vulnerablity assessment on one of the most selling after marrket car infotainment unit.
Creating Persistent Backdoor on Oncord+ android/ios car infotaiment unit using malicious script!

About Device:
**Android version : 12

Kernel Version : 4.9.170

Model : TS17/Powered by Allwinner

Serial number : 0x03125dBa
**

![shared image(2)](https://github.com/abbiy/Backdooring-Oncord-Android-Sterio-/assets/19267773/edc00056-2786-49a7-8481-1c2512be0156)

![shared image(6)](https://github.com/abbiy/Backdooring-Oncord-Android-Sterio-/assets/19267773/bde5d881-242b-405e-9a7b-3dae32cafd6f)

![shared image(5)](https://github.com/abbiy/Backdooring-Oncord-Android-Sterio-/assets/19267773/79d3a5b3-c5aa-4e54-a8a6-88f64b34f560)

![shared image(3)](https://github.com/abbiy/Backdooring-Oncord-Android-Sterio-/assets/19267773/db69a10f-0e96-4103-8148-97a59de2550a)

![oncord](https://github.com/abbiy/Backdooring-Oncord-Android-Sterio-/assets/19267773/9534231e-3f09-4ce2-86ab-d8cdb72aa88a)

Android sterio unit by Oncord+ provides excellent performance and maintenance system based on cutting-edge technology. It is most available after market android unit fro cars in India and other countries. 

![images](https://github.com/abbiy/Backdooring-Oncord-Android-Sterio-/assets/19267773/2ae45535-3819-4602-8fc4-cec3a07fe206)

![IMG20240311112328](https://github.com/abbiy/Backdooring-Oncord-Android-Sterio-/assets/19267773/7ce996ac-7cb4-4b84-92e7-cae389960646)

**
_Vulnerability ID	Vulnerability	Severity	CVSS Score

NW-VUL-01	Gaining Root access of the Infotainment Unit by exploiting ADB port	HIGH -	8.4

HW-VUL-02	Gaining Root access through UART Port – Improper Access Control	MEDIUM - 6.4_
**

About Us: 

This research was conducted by **Sanyam Agarwal**  [![Linkedin](https://i.stack.imgur.com/gVE0j.png) LinkedIn](https://www.linkedin.com/in/sanyam-a-2b2b5510/)
  & **Abhay Vishnoi** [![Linkedin](https://i.stack.imgur.com/gVE0j.png) LinkedIn](https://www.linkedin.com/in/abhay-vishnoi3)
 from **FEV Secure Labs** 

文件快照

备注