PT-2023-20958 · Kaios · Kaios

Tom Barrasso · Published 2023-05-01 · Updated 2025-01-30 · CVE-2023-27108

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions KaiOS version 3.0

Description An issue was discovered in the pre-installed Communications application, which exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent, allowing the attacker to send the user's call logs to a remote server via XMLHttpRequest or Fetch.

Recommendations For KaiOS version 3.0, consider disabling the Web Activity in the Communications application until a patch is available to prevent unauthorized access to the user's call log. Restrict access to sensitive information to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-27108

Affected Products

Kaios

References · 6

• 🔥 https://kaios.dev/cve/1409490 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-27108 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27108 · Vendor Advisory
• https://t.me/cvenotify/49572 · Telegram Post
• https://gist.github.com/Tombarr/5ed6675f33e0eca149a8b4d38ce76dda · Note
• https://t.me/cvenotify/109220 · Telegram Post