CVE-2019-16243 - CVE House
Back to Database
Status published Medium CVE-2019-16243

On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is...

Vulnerability Description

On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the KaiOS browser, to view and edit the device's firmware over-the-air update settings. (This web API is normally used by the system application to trigger firmware updates via OmaService.js.)

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-16243

Credits & Attribution

No credits recorded in the NVD database.

References

More from alcatelmobile

View All →
CVE-2019-16242
On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is...
Medium 6.8
CVE-2019-16241
On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, PIN authentication...
Medium 6.8

Affected Vendor

alcatelmobile

View all reports →

Affected Software

cingular flip 2 firmware
Vulnerable Versions:
b9huah1

Timeline

Official Publish: November 26th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.