CVE-2018-16267

The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Such actions include the triggering system poweroff menu, and prompting a popup with arbitrary strings. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.

• CWE-269

• https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdfThird Party Advisory
• https://review.tizen.org/git/?p=platform/core/system/system-popup.git%3Ba=commit%3Bh=57b3c2f3cd61c6f432e7abe3a2d8b0df72fd4b0e
• https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.beThird Party Advisory
• https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdfThird Party Advisory
• https://review.tizen.org/git/?p=platform/core/system/system-popup.git%3Ba=commit%3Bh=57b3c2f3cd61c6f432e7abe3a2d8b0df72fd4b0e
• https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.beThird Party Advisory

Published

Jan 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16261In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and …
• CVE-2018-16262The pkgmgr system service in Tizen allows an unprivileged pr…8.8
• CVE-2018-16263The PulseAudio system service in Tizen allows an unprivilege…8.8
• CVE-2018-16264The BlueZ system service in Tizen allows an unprivileged pro…6.5
• CVE-2018-16265The bt/bt_core system service in Tizen allows an unprivilege…6.5
• CVE-2018-16266The Enlightenment system service in Tizen allows an unprivil…8.1
• CVE-2018-16268The SoundServer/FocusServer system services in Tizen allow a…4.3
• CVE-2018-16269The wnoti system service in Samsung Galaxy Gear series allow…7.5
• CVE-2018-16270Samsung Galaxy Gear series before build RE2 includes the hci…7.5
• CVE-2018-16271The wemail_consumer_service (from the built-in application w…6.5
• CVE-2018-16272The wpa_supplicant system service in Samsung Galaxy Gear ser…9.8
• CVE-2018-16275OPSWAT MetaDefender before v4.11.2 allows CSV injection.