Multiple vulnerabilities in Unisoc chipsets

1) Information exposure

EUVDB-ID: #VU82781

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42645

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the sim service in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Missing Authorization

EUVDB-ID: #VU82793

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42655

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the sim service in Android. A remote attacker can trick the victim to open a specially crafted file and read and manipulate data.

Install security update from vendor's website.

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information exposure

EUVDB-ID: #VU82792

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42654

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the dm service in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Missing Authorization

EUVDB-ID: #VU82791

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48460

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a possible undefined behavior due to incorrect error handling within the setting service in Android. A local application can perform service disruption.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU82790

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42750

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the gnss service in WCN. A local application can read and manipulate data.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds write

EUVDB-ID: #VU82789

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42653

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a local privileged application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the faceid service in Android. A local privileged application can perform a denial of service (DoS) attack.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Missing Authorization

EUVDB-ID: #VU82788

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42652

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

The vulnerability allows a local application to manipulate data.

The vulnerability exists due to a possible missing permission check within the engineermode in Android. A local application can manipulate data.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Information exposure

EUVDB-ID: #VU82787

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42651

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the engineermode in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information exposure

EUVDB-ID: #VU82786

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42650

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the engineermode in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Information exposure

EUVDB-ID: #VU82785

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42649

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the engineermode in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Information exposure

EUVDB-ID: #VU82784

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42648

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the engineermode in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Information exposure

EUVDB-ID: #VU82783

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42647

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the Ifaa service in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Information exposure

EUVDB-ID: #VU82782

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42646

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the Ifaa service in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Information exposure

EUVDB-ID: #VU82780

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42644

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a possible missing permission check within the dm service in Android. A local application can perform service disruption.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Information exposure

EUVDB-ID: #VU82767

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42631

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Information exposure

EUVDB-ID: #VU82779

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42643

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Information exposure

EUVDB-ID: #VU82778

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42642

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Information exposure

EUVDB-ID: #VU82777

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42641

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Information exposure

EUVDB-ID: #VU82776

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42640

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Information exposure

EUVDB-ID: #VU82775

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42639

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Information exposure

EUVDB-ID: #VU82774

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42638

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Information exposure

EUVDB-ID: #VU82773

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42637

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Information exposure

EUVDB-ID: #VU82772

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42636

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Information exposure

EUVDB-ID: #VU82771

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42635

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Information exposure

EUVDB-ID: #VU82770

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42634

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Information exposure

EUVDB-ID: #VU82769

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42633

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Information exposure

EUVDB-ID: #VU82768

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42632

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the validationtools in Android. A local application can gain access to sensitive information.

Install security update from vendor's website.

SC7731E: All versions

SC9832E: All versions

SC9863A: All versions

T310: All versions

T606: All versions

T612: All versions

T616: All versions

T610: All versions

T618: All versions

T760: All versions

T770: All versions

T820: All versions

S8000: All versions

http://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.