{
    "id": "CVE-2019-15027",
    "published": "2019-08-14 13:15:11",
    "last_modified": "2026-06-17 02:19:33",
    "cvss_score": "9.8",
    "cvss_severity": "CRITICAL",
    "cvss_version": "3.0",
    "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": "CWE-78",
    "description": "The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arbitrary commands as root via shell metacharacters in a filename under /data, because clear_emmc_nomedia_entry in platform/mt6577/external/meta/emmc/meta_clr_emmc.c invokes 'system(\"/system/bin/rm -r /data/' followed by this filename upon an eMMC clearance from a Meta Mode boot. NOTE: compromise of Fire OS on the Amazon Echo Dot would require a second hypothetical vulnerability that allows creation of the required file under /data.",
    "epss_score": "0.03181",
    "epss_percentile": "0.87713",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 0,
    "updated_at": "2026-10-10 18:17:20",
    "priority": {
        "rank": 3,
        "label": "In your normal cycle",
        "why": "Critical by CVSS (9.8), but no sign of active exploitation."
    },
    "products": [
        {
            "vendor": "mediatek",
            "product": "mt6577"
        },
        {
            "vendor": "mediatek",
            "product": "mt6577_firmware"
        },
        {
            "vendor": "mediatek",
            "product": "mt6625"
        },
        {
            "vendor": "mediatek",
            "product": "mt6625_firmware"
        },
        {
            "vendor": "mediatek",
            "product": "mt8163"
        },
        {
            "vendor": "mediatek",
            "product": "mt8163_firmware"
        }
    ],
    "kev_detail": null,
    "exploits": [],
    "refs_list": [
        "https://dojo.bullguard.com/dojo-by-bullguard/blog/gaining-rooting-primitives-for-android-mediatek-chips/",
        "https://github.com/andr3jx/MTK6577/blob/238012ebf18e3751397884d1742ff7ab6417e80d/mediatek/platform/mt6577/external/meta/emmc/meta_clr_emmc.c#L302-L305",
        "https://dojo.bullguard.com/dojo-by-bullguard/blog/gaining-rooting-primitives-for-android-mediatek-chips/",
        "https://github.com/andr3jx/MTK6577/blob/238012ebf18e3751397884d1742ff7ab6417e80d/mediatek/platform/mt6577/external/meta/emmc/meta_clr_emmc.c#L302-L305"
    ]
}