Samsung Gear Sport Firmware vulnerabilities

4 CVEs affecting Samsung Gear Sport Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-16272, published 2020-01-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-16272, published 2020-01-22. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This…
CVE-2018-16269, published 2020-01-22. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security policy configurations. This…
CVE-2018-16270, published 2020-01-22. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary…
CVE-2018-16271, published 2020-01-22. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy…