CVE-2019-15472

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy_sprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.

• CWE-610

• https://www.kryptowire.com/android-firmware-2019/Third Party Advisory
• https://www.kryptowire.com/android-firmware-2019/Third Party Advisory

Published

Nov 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15467The Xiaomi Mi Mix 2S Android device with a build fingerprint…3.3
• CVE-2019-15468The Xiaomi Mi A2 Lite Android device with a build fingerprin…5.5
• CVE-2019-15469The Xiaomi Mi Pad 4 Android device with a build fingerprint …5.5
• CVE-2019-1547Normally in OpenSSL EC groups always have a co-factor presen…4.7
• CVE-2019-15470The Xiaomi Redmi Note 6 Pro Android device with a build fing…5.5
• CVE-2019-15471The Xiaomi Mi Mix 2S Android device with a build fingerprint…5.5
• CVE-2019-15473The Xiaomi Mi A2 Lite Android device with a build fingerprin…5.5
• CVE-2019-15474The Xiaomi Cepheus Android device with a build fingerprint o…5.5
• CVE-2019-15475The Xiaomi Mi A3 Android device with a build fingerprint of …5.5
• CVE-2019-15476Former before 4.2.1 has XSS via a checkbox value.
• CVE-2019-15477Jooby before 1.6.4 has XSS via the default error handler.
• CVE-2019-15478Status Board 1.1.81 has reflected XSS via logic.ts.