CVE-2024-1608

The error results from improper permission verification (CWE-280 — Improper Handling of Insufficient Permissions or Privileges). The permission control mechanism in the SDK is weak enough that an attacker or malicious application can gain access to resources and data that should be protected. The vulnerability is remotely exploitable (network vector), does not require user interaction, though it requires high-level permissions (PR:H). The scope of the attack extends beyond the component in which the vulnerability occurs (Scope: Changed).

An attacker can gain unauthorized access to internal application information, resulting in a breach of confidentiality, integrity, and data availability. The vulnerability may lead to the disclosure of sensitive data stored by the SDK without the user's knowledge and consent.

Patches available from the manufacturer should be applied in accordance with references published on the OPPO Security page (https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1759867611954552832). It is recommended to update the SDK to the version indicated by the manufacturer as secure.

OPPO Usercenter Credit Software Development Kit — specific versions indicated in the manufacturer's references (OPPO Security Notice page).