Lucene search

[email protected]CVE-2011-4872

HistoryOct 03, 2022 - 4:15 p.m.

CVE-2011-4872

2022-10-0316:15:14

CWE-200

[email protected]

web.nvd.nist.gov

cve-2011-4872

htc

android devices

wi-fi

credential leakage

remote attack

nvd

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.9%

JSON

Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.

Affected configurations

NVD

Node

htcdesire_hdMatchfrg83d

htcdesire_hdMatchgri40

htcdesire_sMatchgri40

htcdroid_incredibleMatchfrf91

htcevo_3dMatchgri40

htcevo_4gMatchgri40

htcglacierMatchfrg83

htcsensation_4gMatchgri40

htcsensation_z710eMatchgri40

htcthunderbolt_4gMatchfrg83d

CPENameOperatorVersion
htc:desire_hdhtc desire hdeqfrg83d
htc:desire_hdhtc desire hdeqgri40
htc:desire_shtc desire seqgri40
htc:droid_incrediblehtc droid incredibleeqfrf91
htc:evo_3dhtc evo 3deqgri40
htc:evo_4ghtc evo 4geqgri40
htc:glacierhtc glaciereqfrg83
htc:sensation_4ghtc sensation 4geqgri40
htc:sensation_z710ehtc sensation z710eeqgri40
htc:thunderbolt_4ghtc thunderbolt 4geqfrg83d

CPE	Name	Operator	Version
htc:desire_hd	htc desire hd	eq	frg83d
htc:desire_hd	htc desire hd	eq	gri40
htc:desire_s	htc desire s	eq	gri40
htc:droid_incredible	htc droid incredible	eq	frf91
htc:evo_3d	htc evo 3d	eq	gri40
htc:evo_4g	htc evo 4g	eq	gri40
htc:glacier	htc glacier	eq	frg83
htc:sensation_4g	htc sensation 4g	eq	gri40
htc:sensation_z710e	htc sensation z710e	eq	gri40
htc:thunderbolt_4g	htc thunderbolt 4g	eq	frg83d

References

archives.neohapsis.com/archives/bugtraq/2012-02/0002.html

blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html

secunia.com/advisories/47837

www.kb.cert.org/vuls/id/763355

www.securityfocus.com/bid/51790

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.9%

JSON

Related for CVE-2011-4872

prion1 nvd1 cert1 cvelist1