Unscored severity · published May 1, 2012
CVE-2012-2217
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before…
–
CVSS
2%
EPSS
No
On KEV
Description
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E3
Evo 3d · Htc
gri40 · source: NVD
E3
Evo 3d Software · Htc
through 2.08.651.3; 1.11.651.3; 1.13.651.7; 2.08.651.2 · source: NVD
E4
Evo 4g · Htc
gri40 · source: NVD
E4
Evo 4g Software · Htc
through 4.54.651.1; 1.32.651.1; 1.47.651.1; 3.26.651.6; 3.29.651.5; 3.30.651.2; +5 more · source: NVD
ED
Evo Design 4g · Htc
All versions, or not specified · source: NVD
ED
Evo Design 4g Software · Htc
through 1.19.651.1; 1.19.651.0 · source: NVD
EV
Evo View 4g · Htc
All versions, or not specified · source: NVD
EV
Evo View 4g Software · Htc
through 1.22.651.2; 1.22.651.1 · source: NVD
HE
Hero · Htc
All versions, or not specified · source: NVD
HS
Hero Software · Htc
1.29.651.1; 1.56.651.2; 2.27.651.5; 2.27.651.6; 2.31.651.7; 2.32.651.2 · source: NVD
S4
Shift 4g · Htc
All versions, or not specified · source: NVD
S4
Shift 4g Software · Htc
through 2.76.651.6; 1.17.651.1; 2.75.651.4; 2.75.651.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2217
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2012-04/0176.html
www.securityfocus.com
http://www.securityfocus.com/bid/53187
www.vsecurity.com
http://www.vsecurity.com/resources/advisory/20120420-1/
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/75080
More from Evo 3d
–
CVE-2011-4872
Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire…
–
CVE-2011-3975
A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the…