CVE-2021-41849

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to servers located in China: user's list of installed apps and device International Mobile Equipment Identity (IMEI). This PII is transmitted to log.skyroam.com.cn using HTTP, independent of whether the user uses the Simo software.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://athack.com/session-details/401Third Party Advisory
https://simowireless.com/Vendor Advisory
https://www.kryptowire.com/android-firmware-2022/Broken Link
https://www.kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed/Exploit, Third Party Advisory
https://athack.com/session-details/401Third Party Advisory
https://simowireless.com/Vendor Advisory
https://www.kryptowire.com/android-firmware-2022/Broken Link
https://www.kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed/Exploit, Third Party Advisory

Timeline

Published: Mar 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-41857.5Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture CVE-2021-418507.8An issue was discovered in Luna Simo PPR1.180610.011/202001031830. A pre-installed app with a package name of com.skyroam.silverhelper write CVE-2021-41867.5Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file CVE-2021-418613.3The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2021-418629.8AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).CVE-2021-418647.8prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multipl CVE-2021-418656.5HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of ser CVE-2021-418665.4MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.CVE-2021-418675.3An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of pa CVE-2021-418689.8OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionalit CVE-2021-418698.8SuiteCRM 7.10.x before 7.10.33 and 7.11.x before 7.11.22 is vulnerable to privilege escalation.CVE-2021-41877.8vim is vulnerable to Use After Free