3.3

CVE-2023-25647

Permission and Access Control Vulnerability in Some ZTE Mobile Phones



There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zte ≫ Axon 30 Firmware Version < 3.0.0b06
   Zte ≫ Axon 30 Version -
Zte ≫ Axon 40 Pro Firmware Version < 1.0.0b16
   Zte ≫ Axon 40 Pro Version -
Zte ≫ Axon 40 Ultra Firmware Version < 2.0.0b17
   Zte ≫ Axon 40 Ultra Version -
Zte ≫ Nubia Z50 Firmware Version < 1.0.0b19mr
   Zte ≫ Nubia Z50 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.163
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.3 1.8 1.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
psirt@zte.com.cn 4.7 1 3.6
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264
Vendor Advisory