Vulnerabilities

A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps.

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps.

An improper authentication vulnerability was discovered in the Motorola Factory Test component (com.motorola.motocit).

A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Application that could allow a nearby attacker within the Bluetooth interaction range…

A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate privileges during installation of the software.

An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.

Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial of service.

An authentication bypass vulnerability could allow an attacker to access API functions without authentication.

A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request.

A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API request.

An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.

An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.

The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.

An Implicit intent vulnerability was reported in the Motorola framework that could allow an attacker to read telephony-related data.

An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProvider) that could allow a local attacker to read local data.

A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitation, could allow for a local attacker to read arbitrary files.

An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of the device without authorization.

An improper absolute path traversal vulnerability was reported for the Ready For application allowing a local application access to files without authorization.

An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exported content provider.

A PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to access files or interact with non-exported software components without permission.

A path traversal vulnerability was reported in the Motorola Ready For application that could allow a local attacker to access local files.

An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data.

An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unauthorized Activities.

An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands.

A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information.