What is CVE-2024-12993?

CVE-2024-12993 is a vulnerability in Infinix Mobile Com.rlk.weathers, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. Published 2024-12-30.

Is CVE-2024-12993 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Infinix Mobile Com.rlk.weathers

CVE-2024-12993

Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An attacker can communicate with the provider and reveal the user’s location without any privileges. After multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affects all Infinix Mobile devices.

EPSS: 0.002 (16.1th percentile) — read the EPSS interpretation.

Affected products

Infinix Mobile Com.rlk.weathers — versions 7.0.0.037

Weakness classification (CWE)

CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cvd@cert.pl (third-party-advisory)
cvd@cert.pl (third-party-advisory)

Frequently asked questions

What is CVE-2024-12993?: CVE-2024-12993 is a vulnerability in Infinix Mobile Com.rlk.weathers, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. Published 2024-12-30.
Is CVE-2024-12993 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.