CVE-2019-15027 - CVE House
Back to Database
Status published Critical CVE-2019-15027

The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on...

Vulnerability Description

The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arbitrary commands as root via shell metacharacters in a filename under /data, because clear_emmc_nomedia_entry in platform/mt6577/external/meta/emmc/meta_clr_emmc.c invokes 'system("/system/bin/rm -r /data/' followed by this filename upon an eMMC clearance from a Meta Mode boot. NOTE: compromise of Fire OS on the Amazon Echo Dot would require a second hypothetical vulnerability that allows creation of the required file under /data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-15027

Credits & Attribution

No credits recorded in the NVD database.

References

More from mediatek

View All →
CVE-2021-41789
In wifi driver, there is a possible system crash due...
Medium 6.5
CVE-2021-41788
MediaTek microchips, as used in NETGEAR devices through 2021-12-13 and...
Medium 6.5
CVE-2021-40148
In Modem EMM, there is a possible information disclosure due...
High 7.5
CVE-2021-37584
MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and...
High 8.2
CVE-2021-37583
MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and...
High 8.2

Affected Vendor

Affected Software

mt8163 firmware, mt6625 firmware, mt6577 firmware
Vulnerable Versions:
Unknown

Timeline

Official Publish: August 14th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.