CVE-2023-42674

EUVD-2023-47106 · Published Dec 4, 2023

In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

Technologies

Unisoc T610Unisoc T616Unisoc T612Unisoc T618Unisoc T770Unisoc Sc9863AUnisoc T820Unisoc S8000Google AndroidUnisoc Sc9832EUnisoc T310Unisoc T606Unisoc Sc7731EUnisoc T760

Weaknesses

CWE-862

CVSS scores

v3.15.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Persistence Privilege Escalation Stealth Defense Impairment Credential Access

T1068Exploitation for Privilege Escalation T1211Exploitation for Stealth T1542.002Component Firmware T1556Modify Authentication Process

References

https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049

Potentially impacted assets

See if this affects your attack surface