What is the CVSS score of CVE-2012-2980?

CVE-2012-2980 has a CVSS 2.0 base score of 7.1 (High). CVSS vector: AV:N/AC:M/Au:N/C:C/I:N/A:N. EPSS exploitation probability: 3.2%.

Status CVE-2012-2980

HIGH

Credentials Management Errors (CWE-255)

2012-08-21 cret@cert.org

Samsung Google Authentication Bypass Status Chacha Desire Merge Galaxy S Evo Shift 4G G2 Mytouch 3G Slide Mytouch 4G Slide

7.1

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:M/Au:N/C:C/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:C/I:N/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Aug 21, 2012 - 10:46 cve.org

HIGH 7.1

DescriptionCVE.org

The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remote attackers to obtain sensitive information via a crafted application, as demonstrated by PIN numbers, telephone numbers, and text messages.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-255. The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remote attackers to obtain sensitive information via a crafted application, as demonstrated by PIN numbers, telephone numbers, and text messages. Affected products include: Att Status, Htc Chacha, Htc Desire, Htc Merge, Samsung Galaxy S.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.