title: Permission and Access Control Vulnerability in Some ZTE Mobile Phones
description:
There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.
problem types: CWE-269 Improper Privilege Management
affected:
{
defaultStatus: unaffected
platforms: Android
product: Some ZTE Mobile Phones
vendor: ZTE
versions:
lessThanOrEqual: V1.0.0B07, status: affected, version: NON_EEA_P870F21V1.0.0B01, versionType: V1.0.0B07
lessThanOrEqual: V1.0.0B18MR, status: affected, version:  GEN_ZTE_PQ82A01V1.0.0B01MR, versionType: V1.0.0B18MR
lessThanOrEqual: V3.0.0B05, status: affected, version: GEN_ZTE_P870A01V3.0.0B01, versionType: V3.0.0B05
lessThanOrEqual: V2.0.0B16, status: affected, version: GEN_ZTE_P898A01V2.0.0B01, versionType: V2.0.0B16
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL