CVE-2021-40148 Information disclosure in n/a
Remote attackers can disclose sensitive information from Android Modem EMM due to missing data encryption, requiring no user interaction or privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-40148?
CVE-2021-40148 is a high-severity vulnerability in Mediatek Nr15, published on 4 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00716585; Issue ID: ALPS05886933.
Weakness: CWE-319
Which versions are affected by CVE-2021-40148?
It affects 6 products.
Products include Mediatek L9, Mediatek Lr11, Mediatek Lr12, Mediatek Lr12a, Mediatek Lr13, Mediatek Nr15.
How do I fix CVE-2021-40148?
Apply the vendor's patch.
Is CVE-2021-40148 being exploited?
There is no known exploitation of CVE-2021-40148 in the wild and no public exploit code.
Sources
Also known as A-204728248, ASB-A-204728248, GHSA-qcmm-58xj-wh4r, M-MOLY00716585.