PT-2025-2998 · Unknown · Com.Glitter.Caller.Screen

Edward Warren · CVE-2024-53931 · Published 2025-01-06 · Updated 2025-01-07

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions com.glitter.caller.screen versions 1.1 and earlier

Description The issue allows any application to place phone calls without user interaction by sending a crafted intent via the com.glitter.caller.screen.DialerActivity component. This enables unauthorized call execution.

Recommendations For versions 1.1 and earlier, as a temporary workaround, consider disabling the com.glitter.caller.screen.DialerActivity component until a patch is available. Restrict access to the com.glitter.caller.screen application to minimize the risk of exploitation. Avoid using the com.glitter.caller.screen application for making phone calls until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insecure Storage of Sensitive Information

Incorrect Permission

Weakness Enumeration

CWE-922

CWE-732

Related Identifiers

CVE-2024-53931

Affected Products

Com.Glitter.Caller.Screen

References · 5

• 🔥 https://github.com/actuator/com.glitter.caller.screen/blob/main/CVE-2024-53931 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53931 · Security Note
• https://twitter.com/VulmonFeeds/status/1876444690431594965 · Twitter Post
• https://t.me/cvedetector/14410 · Telegram Post
• https://twitter.com/CVEnew/status/1876396468053172342 · Twitter Post