CVE-2020-15165 – CVE-2020-15165 affects Chameleon Mini Live Debu... (How to Fix)

Q: What is the severity of CVE-2020-15165?

CVE-2020-15165 has a CVSS score of 9.3 (CRITICAL). CVE-2020-15165 affects Chameleon Mini Live Debugger version 1.1.6-free on Google Play Store, where the app may have been tampered with by a malicious actor, potentially modifying sources or permissions. All users of this version are affected and could be running compromised software. The vulnerability allows unauthorized code execution or data access through a maliciously modified app.

📋 TL;DR

CVE-2020-15165 affects Chameleon Mini Live Debugger version 1.1.6-free on Google Play Store, where the app may have been tampered with by a malicious actor, potentially modifying sources or permissions. All users of this version are affected and could be running compromised software. The vulnerability allows unauthorized code execution or data access through a maliciously modified app.

💻 Affected Systems

Products:

Chameleon Mini Live Debugger

Versions: Version 1.1.6-free only

Operating Systems: Android

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects the specific version distributed on Google Play Store; other versions may be safe.

📦 What is this software?

Chameleon Mini Live Debugger by Chameleon Mini Live Debugger Project

View all CVEs affecting Chameleon Mini Live Debugger →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of device data, unauthorized access to NFC/RFID functionality, installation of additional malware, and credential theft.

🟠

Likely Case

Unauthorized data access, potential privilege escalation, and exposure of sensitive information stored or processed by the app.

🟢

If Mitigated

Limited impact if app is isolated with minimal permissions and device has security controls, but still represents elevated risk.

🌐 Internet-Facing: HIGH - App is distributed via Google Play Store, making it widely accessible and potentially affecting many users.

🏢 Internal Only: LOW - This is a mobile app vulnerability, not typically deployed in internal enterprise environments.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires users to install the tampered version from Google Play Store; no additional technical steps needed once installed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: v1.1.8

Vendor Advisory: https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6

Restart Required: Yes

Instructions:

1. Open Google Play Store. 2. Search for 'Chameleon Mini Live Debugger'. 3. If update is available, tap 'Update'. 4. If already on v1.1.8, ensure no older versions are installed. 5. Restart device after update.

🔧 Temporary Workarounds

Uninstall vulnerable version

android

Remove the potentially compromised app from your device

Settings > Apps > Chameleon Mini Live Debugger > Uninstall

Disable app permissions

android

Restrict app permissions to minimize potential damage

Settings > Apps > Chameleon Mini Live Debugger > Permissions > Disable all

🧯 If You Can't Patch

Immediately uninstall the app from all devices
Monitor devices for unusual activity and consider factory reset if compromise is suspected

🔍 How to Verify

Check if Vulnerable:

Check app version in Settings > Apps > Chameleon Mini Live Debugger > App info. If version is 1.1.6-free, you are vulnerable.

Check Version:

Not applicable for mobile apps; check via device settings as described.

Verify Fix Applied:

Verify app version shows 1.1.8 or higher in Settings > Apps > Chameleon Mini Live Debugger > App info.

📡 Detection & Monitoring

Log Indicators:

Unusual app behavior logs
Permission escalation attempts
Unexpected network connections from the app

Network Indicators:

Unexpected outbound connections from the app to unknown domains

SIEM Query:

Not typically applicable for mobile app vulnerabilities in enterprise SIEMs

📊 Metadata

CVE ID: CVE-2020-15165

CVSS v3 Score: 9.3 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE: CWE-506

Published: August 28, 2020

Last Updated: November 21, 2024

🔗 References

https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6 Exploit,Third Party Advisory
https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US Product,Third Party Advisory
https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6 Exploit,Third Party Advisory
https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US Product,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-15165, you might also want to check these: