CVE-2023-42716
📋 TL;DR
CVE-2023-42716 is a missing permission check vulnerability in telephony services that could allow remote attackers to access sensitive information without requiring additional execution privileges. This affects devices using vulnerable telephony implementations, potentially exposing call logs, contact information, or other telephony-related data.
💻 Affected Systems
- Unisoc telephony implementations
- Devices using Unisoc chipsets
📦 What is this software?
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains unauthorized access to sensitive telephony data including call records, contact information, and potentially location data without user interaction.
Likely Case
Information disclosure of telephony metadata and potentially sensitive user data to malicious apps or network attackers.
If Mitigated
Limited impact with proper permission controls and network segmentation in place.
🎯 Exploit Status
No authentication required for exploitation; complexity is low due to missing permission check
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references; check vendor advisory for specific patched versions
Vendor Advisory: https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049
Restart Required: Yes
Instructions:
1. Check with device manufacturer for available security updates 2. Apply the latest security patch from vendor 3. Reboot device after patch installation
🔧 Temporary Workarounds
Network segmentation
allRestrict network access to telephony services
App permission review
androidReview and restrict app permissions related to telephony services
🧯 If You Can't Patch
- Implement network segmentation to isolate telephony services
- Monitor for suspicious access attempts to telephony APIs
🔍 How to Verify
Check if Vulnerable:
Check device manufacturer security bulletins and compare with current software versionCheck Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level includes CVE-2023-42716 fix and test telephony permission enforcement📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to telephony APIs
- Permission denial logs for telephony services
Network Indicators:
- Unexpected network traffic to telephony service ports
- Anomalous API calls to telephony endpoints
SIEM Query:
telephony_api_access AND (permission_denied OR unauthorized_access)