CVE-2023-44126: falha de baixa gravidade em LG V60 Thin Q 5G(LMV600VM)
Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.6epss 0.1%
The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers, contacts info, etc.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Produtos afetados
LG Electronics · LG V60 Thin Q 5G(LMV600VM)CVEs relacionadas — LG V60 Thin Q 5G(LMV600VM)
No mesmo produto, das mais perigosas para as menos.
CVE-2023-44123MEDIUMBluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijackingEPSS 0.1%CVE-2023-44125MEDIUMPersonalized service - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijackingEPSS 0.1%CVE-2023-44127LOWCall management - Implicit activity intents disclose contact details and phone numbersEPSS 0.1%CVE-2023-44122MEDIUMLockScreenSettings - Theft arbitrary files with system privilegeEPSS 0.1%CVE-2023-44121MEDIUMLG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhereEPSS 0.1%CVE-2023-44129LOWMessaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivityEPSS 0.1%