Vulnerability Name:

CVE-2020-11836 (CCN-196459)

Assigned:2020-04-16
Published:2021-02-04
Updated:2021-02-08
Summary:OPPO Android Phone with MTK chipset and Android 8.1/9/10/11 versions have an information leak vulnerability. The “adb shell getprop ro.vendor.aee.enforcing” or “adb shell getprop ro.vendor.aee.enforcing” return no.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
6.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.9 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2020-11836

Source: XF
Type: UNKNOWN
oppo-cve202011836-info-disc(196459)

Source: CCN
Type: OPPO Security Web site
MTK AEE module is in debug mode

Source: MISC
Type: Vendor Advisory
https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1357213888449617920

Vulnerable Configuration:Configuration 1:
  • cpe:/o:google:android:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:11.0:*:*:*:*:*:*:*
  • AND
  • cpe:/h:oppo:a12:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:a15:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:a15s:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:a31:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:a33:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:a5:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:a52:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:a53:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:a9:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:f15:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:f17:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:f17_pro:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:reno_5_pro_5g:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:reno_3_pro:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:reno_4_pro:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:reno_2f:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:reno_2z:-:*:*:*:*:*:*:*
  • OR cpe:/h:oppo:reno_2:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    google android 8.1
    google android 9.0
    google android 10.0
    google android 11.0
    oppo a12 -
    oppo a15 -
    oppo a15s -
    oppo a31 -
    oppo a33 -
    oppo a5 -
    oppo a52 -
    oppo a53 -
    oppo a9 -
    oppo f15 -
    oppo f17 -
    oppo f17 pro -
    oppo reno 5 pro 5g -
    oppo reno 3 pro -
    oppo reno 4 pro -
    oppo reno 2f -
    oppo reno 2z -
    oppo reno 2 -