PT-2023-29115 · Lg · Lg Thinq Service

Published 2023-09-27 · Updated 2023-10-02 · CVE-2023-44121

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LG ThinQ Service (affected versions not specified)

Description The issue is an intent redirection in the LG ThinQ Service, specifically in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This could be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.notification.ACTION". The severity of this issue is heightened because LG ThinQ Service is a system app, which could lead to accessing arbitrary not exported activities of all apps.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-926

Related Identifiers

CVE-2023-44121

Affected Products

Lg Thinq Service

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-44121 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44121 · Vendor Advisory
• https://lgsecurity.lge.com/bulletins/mobile#updateDetails · Vendor Advisory
• https://twitter.com/CVEnew/status/1706955049614627211 · Twitter Post