There is a command injection problem in the old version of the mobile phone backup app.
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1684402464721477632 | vendor advisory |