sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2018-5892 Information disclosure in Snapdragon Mobile, Snapdragon Wear

High 7.5 Published Updated

The Touch Pal application in Snapdragon devices collects user behavior data without user awareness, leading to privacy violations.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2018-5892?

CVE-2018-5892 is a high-severity vulnerability in Qualcomm Mdm9206 Firmware, published on 6 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Touch Pal application can collect user behavior data without awareness by the user in Snapdragon Mobile and Snapdragon Wear.

Weakness: CWE-200

Which versions are affected by CVE-2018-5892?

It affects 27 products.

Products include Qualcomm Mdm9206 Firmware, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9650 Firmware, Qualcomm Msm8996au Firmware, Qualcomm Sd 205 Firmware, Qualcomm Sd 210 Firmware and 21 more.

How do I fix CVE-2018-5892?

No fix has been published for CVE-2018-5892 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-5892 being exploited?

There is no known exploitation of CVE-2018-5892 in the wild and no public exploit code.

All Qualcomm Mdm9206 Firmware vulnerabilities

Sources

Also known as GHSA-rwxc-fr6w-9h93.

Is CVE-2018-5892 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free