Information exposure in UNISOC products - CVE-2024-39441

Vulnerability identifier: #VU105228

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-39441

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the wifi display in Android. A remote attacker can trick the victim to open a specially crafted file and read and manipulate data.

T310
T606
T612
T616
T610
T618
T750
T765
T760
T770
T820
S8000
Samsung Mobile Firmware
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 12L 2025-02-05, 12 2025-02-05, 13 2025-02-05, 14 2025-02-05, 15 2025-02-05
Samsung Mobile Firmware - update to SMR-MAR-2025

• https://www.unisoc.com/en_us/secy/announcementDetail/1894203086612791298

• Security restrictions bypass in Unisoc chipsets
• Multiple vulnerabilities in Google Android
• Multiple vulnerabilities in Samsung Mobile Firmware (March 2025)