CVE-2015-4640
LOW 2.9EPSS 0.9%
The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution.
- CVSS v2.0
- 2.9 LOW
AV:A/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 0.95% chance of exploitation in the next 30 days, 59th percentile
- Published
- 2015-06-19
- Updated
- 2024-08-06
Proof-of-concept exploits (2)
- nowsecure/samsung-ime-rce-poc/
- http://arstechnica.com/security/2015/06/new-exploit-turns-samsung-galaxy-phones-into-remo…