CVE-2019-6742
9.8
CRITICAL · CVSS 3.1 · EPSS 5.9% (pctl 93)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the GameServiceReceiver update mechanism. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7477.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 5.93% — more likely to be exploited than 93% of all CVEs |
| Weakness | CWE-358 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-06-03 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| samsung | galaxy s9 |
| samsung | galaxy s9 firmware |
References
→ the Explorer · watch your stack · NVD