CVE-2024-12993 — Location information exposure in Infinix Weather app

CVE-2024-12993

Location information exposure in Infinix Weather app PUBLISHED

Description (CNA)

Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An attacker can communicate with the provider and reveal the user’s location without any privileges. After multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affects all Infinix Mobile devices.

Affected (CNA)

Vendor / product	Versions
Infinix Mobile / com.rlk.weathers	affected 7.0.0.037

CWE

CWE-497

References

https://cert.pl/en/posts/2024/12/CVE-2024-12993/
https://cert.pl/posts/2024/12/CVE-2024-12993/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.