Unscored severity · published Aug 12, 2012
CVE-2012-4248
The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified…
–
CVSS
3.5%
EPSS
No
On KEV
Description
The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the (1) dev.log, (2) lipc.set, (3) lipc.get, or (4) todo.scheduleItems method, a different vulnerability than CVE-2012-4249.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KT
Kindle Touch · Amazon
through 5.1.1; 5.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4248
US Government Resource
http://www.kb.cert.org/vuls/id/122656
www.kb.cert.org
http://www.kb.cert.org/vuls/id/MORO-8WKGBN
www.mobileread.com
http://www.mobileread.com/forums/showthread.php?s=c7953cc553a4aaa36e880b25aa1a6bf6&t=175368
More from Kindle Touch
–
CVE-2012-4249
The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell…