PT-2024-27669 · Unknown · Com.Grice.Call

Edward Warren · Published 2024-12-04 · Updated 2024-12-12 · CVE-2024-37574

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions com.grice.call application version 4.5.2

Description The issue allows any installed application, even those without permissions, to place phone calls without user interaction by sending a crafted intent via the com.iui.mobile.presentation.MobileActivity. This enables unauthorized phone calls, potentially leading to security breaches or unwanted charges.

Recommendations For version 4.5.2, consider disabling the com.iui.mobile.presentation.MobileActivity until a patch is available to prevent unauthorized phone calls. Restrict access to the application's functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2024-37574

Affected Products

Com.Grice.Call

References · 8

• 🔥 https://github.com/actuator/com.grice.call/blob/main/CVE-2024-37574 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37574 · Security Note
• https://github.com/actuator/com.grice.call · Note
• https://t.me/cvedetector/12015 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1864478683542573171 · Twitter Post
• https://t.me/cvenotify/103941 · Telegram Post
• https://play.google.com/store/apps/details?id=com.grice.call · Note
• https://twitter.com/CVEnew/status/1864336595093950591 · Twitter Post