Motorola OTA Update Application Vulnerability Could Allow HTML Injection
CVE-2023-41827

5.1MEDIUM

Key Information:

Vendor
Motorola
Status
Phones
Vendor
CVE Published:
4 March 2024

Summary

An improper export vulnerability has been identified in the OTA update application by Motorola. This flaw can be exploited by local applications, enabling them to inject HTML-based messages into the user interface. Such an attack may lead to unwanted interactions or display misleading information to users. It's crucial for users and administrators to be aware of this vulnerability and implement appropriate security measures.

Affected Version(s)

Phones < 2023-08-01

References

https://en-us.support.motorola.com/app/answers/detail/a_i...

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sergey Toshin and Illia Khorolskyi of Oversecured (ovesecured.com)
.