漏洞标题
N/A
漏洞描述信息
Leagoo P1 设备，构建指纹识别为 sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys，包含一个预装的平台应用程序，package name为com.wtk.factory(版本Code=1，版本Name=1.0)，其中包含一个名为com.wtk.factory.MMITestReceiver的导出广播接收器，允许任何在设备上共存的应用程序自动启动重置。此外，启动重置的应用程序无需任何权限。重置设备将删除所有用户数据和应用程序。这将导致未备份或同步外部的任何数据丢失。执行重置功能对第三方应用程序(用户自己安装的除外)来说不能直接获得，尽管可以通过利用预装平台应用程序的未加密应用程序组件来获取此功能。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
The Leagoo P1 device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform app with a package name of com.wtk.factory (versionCode=1, versionName=1.0) that contains an exported broadcast receiver named com.wtk.factory.MMITestReceiver allows any app co-located on the device to programmatically initiate a factory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of a pre-installed platform app.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Leagoo P1 授权问题漏洞
漏洞描述信息
Leagoo P1是中国领歌科技（Leagoo）公司的一款基于Android平台的智能手机。 Leagoo P1（build fingerprint为sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys）中的com.wtk.factory包(versionCode=1，versionName=1.0)存在安全漏洞。攻击者可利用该漏洞无需权限便可恢复出厂设置，造成数据丢失。
CVSS信息
N/A
漏洞类别
授权问题