Vulnerability in Chainfire Supersu

CVE-2013-6775

The Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the (1) backtick or (2) $() type of shell metacharacters in the -c option to /system/xbin/su.

EPSS: 0.016 (73.1th percentile) — read the EPSS interpretation.

Affected products

Chainfire Supersu — versions 1.69
Google Android — versions 1.0, 1.1, 1.5
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

cve@mitre.org (mailing-list, Exploit, x_refsource_BUGTRAQ)