Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts
CVE-2023-44126

3.6LOW

Key Information:

Vendor

Lg Electronics

Status
Lg V60 Thin Q 5g(lmv600vm)
Vendor
CVE Published:
27 September 2023

What is CVE-2023-44126?

The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers, contacts info, etc.

Affected Version(s)

LG V60 Thin Q 5G(LMV600VM) Android 8 <= 13

References

https://lgsecurity.lge.com/bulletins/mobile#updateDetails
vendor-advisory

CVSS V3.1

Score:
3.6
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.