Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

oFono

Source

zdi-disclosures@trendmicro.com

CVE-2024-7540 details

Published : Aug. 6, 2024, 12:15 a.m.
Last Modified : Aug. 6, 2024, 4:30 p.m.

Description

oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307.

CVSS Score

1	2	3.3	4	5	6	7	8	9	10

Weakness

Weakness	Name	Description
CWE-457	Use of Uninitialized Variable	The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

CVSS Data

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact