Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-15396: Asus ZenFone 3 pre‑installed app lets other apps run commands

CVE-2019-15396 · published 6 years ago

Summary

The ZenFone 3 includes a pre‑installed utility that other built‑in apps can use to execute commands on the phone. This means any pre‑installed app with certain system permissions could potentially carry out actions without the user’s knowledge. Update the device to the latest firmware from Asus or contact support to have the utility disabled or removed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
asus	zenfone_3_firmware	All versions `cpe:2.3:o:asus:zenfone_3_firmware:-:::::::*`

Original advisory text

The Asus ZenFone 3 Android device with a build fingerprint of asus/WW_Phone/ASUS_Z012D:7.0/NRD90M/14.2020.1708.56-20170719:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=1570000015, versionName=7.0.0.3_161222) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.

References

https://www.kryptowire.com/android-firmware-2019/ Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Timeline

Published14 Nov 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-15396 · NVD

Track software like this

Free during beta