CVE-2023-25647
EUVD-2023-2958617.08.2023, 03:15
There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| zte | axon_30_firmware | 𝑥 < 3.0.0b06 |
| zte | axon_40_pro_firmware | 𝑥 < 1.0.0b16 |
| zte | axon_40_ultra_firmware | 𝑥 < 2.0.0b17 |
| zte | nubia_z50_firmware | 𝑥 < 1.0.0b19mr |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-269 - Improper Privilege ManagementThe software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.