Cybersecurity specialists reported the finding of a critical vulnerability in WeChat, the messaging service, phone calls and social media platform developed by the China-based technology company Tencent. According to the report, successful exploitation of this flaw would allow threat actors to trigger remote code execution scenarios on vulnerable systems.
Below is a brief description of the reported flaw, in addition to its CVE tracking key and score set by the Common Vulnerability Scoring System (CVSS).
Tracked as CVE-2020-27874, this security flaw exists due to a boundary error within the WXAM decoder, which would allow remote threat actors to create a specially designed file, trick the victim into opening it to cause memory corruption and execute arbitrary code on the target system.
This is a high severity flaw that received a CVSS score of 7.7/10.
In their report, cybersecurity experts mention that successful exploitation of this flaw could lead to the total compromise of the vulnerable system.
The flaw lies in the following versions of WeChat: 7.0.0, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.9, 7.0.10, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17 & 7.0.18.
While the vulnerability could be exploited by unauthenticated threat actors over the Internet, cybersecurity experts have not detected attempts at active exploitation or the existence of a malware variant associated with this attack. Fixes are now ready, so WeChat users are advised to upgrade to the latest available versions as soon as possible.
As any other mobile application developed by a company established in China, WeChat mentions to its users that the authorities can dispose of and store the information collected by the application for an indefinite period, so its market is mainly local and independent of the market in the West.
It is no surprise that the Chinese Communist Party requires national companies to allow access to their data centers, thus limiting the use of options such as WhatsApp or Telegram. In reality, this app operates virtually as the official communication channel in China, which poses a great risk to activists, political dissidents and even anyone unhappy with the restrictive measures prevailing in the Asian giant.
For more information on vulnerabilities, exploits, malware variants, cybersecurity risks and information security courses, feel free to access the International Cyber Security Institute (IICS) website.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
