CVE-2011-4872 Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40...
LowCVSS 2.6
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| htc desire hd | = frg83d | No fix listed |
| htc desire hd | = gri40 | No fix listed |
| htc desire s | = gri40 | No fix listed |
| htc droid incredible | = frf91 | No fix listed |
| htc evo 3d | = gri40 | No fix listed |
| htc evo 4g | = gri40 | No fix listed |
| htc glacier | = frg83 | No fix listed |
| htc sensation 4g | = gri40 | No fix listed |
| htc sensation z710e | = gri40 | No fix listed |
| htc thunderbolt 4g | = frg83d | No fix listed |
References
- 20120201 802.1X password exploit on many HTC Android devices mailing-list
- blog.mywarwithentropy.com
- 47837 third-party-advisory vendor-advisory
- VU#763355 third-party-advisory us-government-resource
- 51790 vdb-entry