CVE-2011-4872

Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.

CVSS v2.0

2.6 LOWAV:N/AC:H/Au:N/C:P/I:N/A:N

EPSS

1.40% chance of exploitation in the next 30 days, 71th percentile

Published

2012-02-05

Updated

2024-09-17

Proof-of-concept exploits (2)

• http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html
• http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html

References

• CVE Record
• NVD entry

Related

• CVE-2011-4871
• CVE-2011-4875
• CVE-2011-4862
• CVE-2011-4876
• CVE-2011-4858
• CVE-2011-4877