by Kastro
Paper/Archive/CVE-2024-10576

CVE-2024-10576

Infinix Mobile com.transsion.agingfunction — Unauthorized factory reset of Infinix devices

EPSS 0.2%CVSS 9.4
critical.is priorityof 100
29
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 5.8.058 × 201.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver. An attacker can communicate with the receiver and force the device to perform a factory reset without any Android system permissions.  After multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affects all Infinix Mobile devices.

Affected

ProductAffectedFixed inSource
com.transsion.agingfunction13–CNA
com.transmission.agingfunction13–CISA-ADP

Scores by source

CERT-PL (CNA)9.4CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/R:I/V:D/U:Amber
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupcert.pl/en/posts/2024/12/CVE-2024-10576writeupcert.pl/posts/2024/12/CVE-2024-10576