PT-2023-22377 · Unknown · Bt21 X Bts Wallpaper

Published 2023-06-02 · Updated 2025-01-08 · CVE-2023-29725

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BT21 x BTS Wallpaper app version 12 for Android

Description The issue allows unauthorized applications to request permission to insert data into the database that records user personal preferences. This data is loaded into memory when the application is opened. By injecting data, an attacker can force the application to load malicious image URLs and display them in the UI. As the amount of data increases, it will cause the application to trigger an OOM error and crash, resulting in a persistent denial of service attack.

Recommendations For BT21 x BTS Wallpaper app version 12, consider restricting access to the database that records user personal preferences to prevent unauthorized data injection until a patch is available. As a temporary workaround, avoid using the application with unauthorized permissions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-29725

Affected Products

Bt21 X Bts Wallpaper

References · 9

• 🔥 https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29725/CVE%20detail.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-29725 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29725 · Vendor Advisory
• http://bungaakpstudio007.com · Note
• https://apkpure.com/cn/bt21-x-bts-wallpaper-hd-4k/com.bungaakp007.bt21wallpaperoffline130920/download/12-APK · Note
• https://t.me/cvenotify/106838 · Telegram Post
• https://t.me/cibsecurity/64874 · Telegram Post
• https://t.me/cvenotify/52062 · Telegram Post
• https://play.google.com/store/apps/details?id=com.cuiet.blockCalls · Note