PT-2023-30655 · Unknown · Com.Yunyi.Smartcamera

Published 2023-12-27 · Updated 2024-01-09 · CVE-2023-47882

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions com.yunyi.smartcamera application through 4.1.9 20231127 for Android

Description The issue allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component. This can be achieved by sending an implicit intent to the specified component, potentially allowing the execution of malicious JavaScript code.

Recommendations For versions through 4.1.9 20231127, consider disabling the com.ants360.yicamera.activity.WebViewActivity component as a temporary workaround until a patch is available. Restrict access to this component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-47882

Affected Products

Com.Yunyi.Smartcamera

References · 7

• 🔥 https://github.com/actuator/yi/blob/main/CWE-319.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-47882 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47882 · Vendor Advisory
• https://t.me/cvenotify/66816 · Telegram Post
• https://play.google.com/store/apps/details?id=com.yunyi.smartcamera · Note
• https://twitter.com/VulmonFeeds/status/1740154091555172486 · Twitter Post
• https://twitter.com/CVEnew/status/1740113450670444722 · Twitter Post