CVE-2018-16270

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Jan 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-162716.5The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulat CVE-2018-162729.8The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to CVE-2018-162757.8OPSWAT MetaDefender before v4.11.2 allows CSV injection.CVE-2018-162767.8An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access r CVE-2018-162775.4The Image Import function in XWiki through 10.7 has XSS.CVE-2018-162789.8phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/co CVE-2018-162819.8The DEISER "Profields - Project Custom Fields" app before 6.0.2 for Jira has Incorrect Access Control.CVE-2018-162828.8A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arb CVE-2018-162839.8The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.CVE-2018-162856.1The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/ad CVE-2018-162869.8LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the P CVE-2018-162879.8LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs.