An issue was discovered in Luna Simo PPR1.180610.011/202001031830.

published 2022-03-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-28850

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits: 0; none known

An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to servers located in China: user's list of installed apps and device International Mobile Equipment Identity (IMEI). This PII is transmitted to log.skyroam.com.cn using HTTP, independent of whether the user uses the Simo software.

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

kryptowire.com https://www.kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-319 Cleartext Transmission of Sensitive Information

References

kryptowire.com /blog/vsim-vulnerability-within-simo-android-phones-exposed/
exploit, third-party-advisory
simowireless.com /
vendor-advisory
kryptowire.com /android-firmware-2022/
broken-link
athack.com /session-details/401
third-party-advisory

Sources

CVE List CVE-2021-41849
NVD CVE-2021-41849

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary