Input validation error in Samsung Mobile Firmware - CVE-2023-30671
Published: July 6, 2023
Vulnerability identifier: #VU78006
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-30671
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to downgrade installed apps.
The vulnerability exists due to logic error in package installation via adb command. An attacker with physical access to device can downgrade previously installed apps.
Affected software
Samsung Mobile Firmware
How to mitigate CVE-2023-30671
Install updates from vendor's website.
Samsung Mobile Firmware - update to SMR-JUL-2023