PT-2025-3003 · Asianmobile · Com.Asianmobile.Callcolor

Edward Warren · Published 2025-01-06 · Updated 2025-01-08 · CVE-2024-53936

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions com.asianmobile.callcolor (aka Color Phone Call Screen App) version 24 for Android

Description The issue allows any application to place phone calls without user interaction by sending a crafted intent via the com.asianmobile.callcolor.ui.component.call.CallActivity component. This enables unauthorized phone calls to be made without requiring any permissions.

Recommendations For version 24, consider disabling the com.asianmobile.callcolor.ui.component.call.CallActivity component to prevent unauthorized phone calls until a patch is available. Restrict access to this component to minimize the risk of exploitation. Avoid using the application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2024-53936

Affected Products

Com.Asianmobile.Callcolor

References · 6

• 🔥 https://github.com/actuator/com.asianmobile.callcolor/blob/main/CVE-2024-53936 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53936 · Security Note
• https://github.com/actuator/com.asianmobile.callcolor · Note
• https://twitter.com/CVEnew/status/1876391674143785464 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1876447250756342045 · Twitter Post
• https://t.me/cvedetector/14415 · Telegram Post