Samsung WifiHs20UtilityService Path Traversal
Posted by deepcore on October 28, 2015 – 12:52 pm
A path traversal vulnerability was found in the WifiHs20UtilityService. This service is running on a Samsung S6 Edge device, and may be present on other Samsung device models. WifiHs20UtilityService reads any files placed in /sdcard/Download/cred.zip, and unzips this file into /data/bundle. Directory traversal in the path of the zipped contents allows an attacker to write a controlled file to an arbitrary path as the system user.
Post a reply
You must be logged in to post a comment.