CVE-2019-15365
Description
The Lava Z92 Android device has a pre-installed app (com.mediatek.wfo.impl) that allows any co-located app to modify a system property via an exported interface without authorization, leading to potential system manipulation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
The Lava Z92 Android device has a pre-installed app (com.mediatek.wfo.impl) that allows any co-located app to modify a system property via an exported interface without authorization, leading to potential system manipulation.
Vulnerability
The Lava Z92 Android device (build fingerprint LAVA/Z92/Z92:8.1.0/O11019/1535088037:user/release-keys) includes a pre-installed app with package name com.mediatek.wfo.impl (versionCode=27, versionName=8.1.0). This app exports an interface that allows any other app co-located on the device to modify a system property without proper authorization. [1]
Exploitation
To exploit this vulnerability, an attacker needs only to have any app installed on the device that can call the exported interface. No additional permissions or user interaction are required beyond the app being present. The attacker can then modify a system property, potentially altering device behavior.
Impact
Successful exploitation allows a malicious app to modify a system property, which could lead to changes in device configuration or compromise system stability. This could potentially be leveraged for privilege escalation or disruption of system services. [1]
Mitigation
As of the publication date, no fixed version has been disclosed in the available references. Users may attempt to disable or uninstall the app, but as a pre-installed system app, this may require root access. Lava may release an OTA update to address this issue. [1]
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Lava/Z92description
Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
1- www.kryptowire.com/android-firmware-2019/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.