PT-2024-12705 · Orbic · Orbic Maui

Published 2024-04-22 · Updated 2024-07-03 · CVE-2023-38300

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Orbic Maui device version ORB545L V1.4.2 BVZPP

Description A certain software build for the Orbic Maui device leaks the IMEI and the ICCID to system properties that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in this instance they are leaked by a high-privilege process and can be obtained indirectly. This issue allows a malicious app to read from the persist.sys.verizon test plan imei system property to indirectly obtain the IMEI and reads the persist.sys.verizon test plan iccid system property to obtain the ICCID.

Recommendations As a temporary workaround, consider restricting access to the persist.sys.verizon test plan imei and persist.sys.verizon test plan iccid system properties to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-38300

Affected Products

Orbic Maui

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-38300 · Security Note
• https://t.me/cvenotify/77694 · Telegram Post
• https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf · Note