How severe is CVE-2019-9939?

CVE-2019-9939 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-9939 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-9939?

CVE-2019-9939 affects Ushareit Shareit. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-9939?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-9939 published?

CVE-2019-9939 was published on 2019-03-22 and last updated on 2026-06-17.

CVE-2019-9939

CVE-2019-9939 is a high-severity vulnerability in Ushareit Shareit with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 8.8)
CVSS v2: 5.8
EPSS exploit prediction: 2% (73rd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Ushareit Shareit
Published: 2019-03-22
Last modified: 2026-06-17

Description

The SHAREit application before 4.0.36 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated) to bypass authentication by trying to fetch a non-existing page. When the non-existing page is requested, the application responds with a 200 status code and empty page, and adds the requesting client device into the list of recognized devices.

Frequently asked questions

What is CVE-2019-9939?: The SHAREit application before 4.0.36 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated) to bypass authentication by trying to fetch a non-existing page. When the non-existing page is requested, the application responds with a 200 status code and empty page, and adds the requesting client device into the list of recognized devices.
How severe is CVE-2019-9939?: CVE-2019-9939 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-9939 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-9939?: CVE-2019-9939 affects Ushareit Shareit. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-9939?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2019-9939 published?: CVE-2019-9939 was published on 2019-03-22 and last updated on 2026-06-17.

References

https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files/

Affected products (1)

cpe:2.3:a:ushareit:shareit:*:*:*:*:*:android:*:*

More vulnerabilities in Ushareit Shareit

CVE-2019-15234 — High (CVSS 7.5): SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to…
CVE-2019-14941 — High (CVSS 7.5): SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate…
CVE-2019-9938 — Medium (CVSS 5.3): The SHAREit application before 4.0.42 for Android allows a remote attacker (on the same network or joining public…

All CVEs affecting Ushareit Shareit →