Information disclosure in Htc Desire Hd
CVE-2011-4872
Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v2 metric
CVSS v2 base score 2.6 (Low). Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.013 (69.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 69.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.013 · change: -0.001
Affected products
- Htc Desire Hd — versions frg83d, gri40
- Htc Desire S — versions gri40
- Htc Droid Incredible — versions frf91
- Htc Evo 3d — versions gri40
- Htc Evo 4g — versions gri40
- Htc Glacier — versions frg83
- Htc Sensation 4g — versions gri40
- Htc Sensation Z710e — versions gri40
- Htc Thunderbolt 4g — versions frg83d
Weakness classification (CWE)
References
- www.kb.cert.org/vuls/id/763355 (US Government Resource, third-party-advisory)
- archives.neohapsis.com/archives/bugtraq/2012-02/0002.html (mailing-list)
- secunia.com/advisories/47837 (Vendor Advisory, third-party-advisory)
- blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html
- www.securityfocus.com/bid/51790 (vdb-entry)