PT-2023-29120 · Google · Com.Android.Server.Telecom

Published 2023-09-27 · Updated 2023-10-02 · CVE-2023-44126

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions com.android.server.telecom (affected versions not specified)

Description The issue is related to the Call management app patched by LG, which sends numerous LG-owned implicit broadcasts. These broadcasts disclose sensitive data, including call states, durations, called numbers, and contacts information, to all third-party apps installed on the same device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-925

Related Identifiers

CVE-2023-44126

Affected Products

Com.Android.Server.Telecom

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-44126 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44126 · Vendor Advisory
• https://lgsecurity.lge.com/bulletins/mobile#updateDetails · Vendor Advisory
• https://twitter.com/CVEnew/status/1707036091889365036 · Twitter Post
• https://t.me/cvenotify/58881 · Telegram Post