UNISOC Vowifi Service Command Injection Vulnerability Allowing Remote Privilege Escalation

A command injection vulnerability has been identified in the UNISOC Vowifi service, arising from inadequate input validation. This issue could facilitate remote privilege escalation without requiring additional execution privileges. The vulnerability affects several chipsets, including SL8521E, SL8521ET, SL8541E, UIS8141E, UWS6137, UWS6137E, UWS6151E, and UWS6152. It is present in the Mocor5 software version, specifically within the Android 8.1 and Android 9 environments.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a user to gain elevated rights or access within the system or application.