Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: TCL 30Z (TCL/4188R/Jetta_ATT:12/SP1A.210812.016/LV8E:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU5P:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU61:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU66:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU68:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6P:user/release-keys, and TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6X:user/release-keys) and TCL A3X (TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAAZ:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB3:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB7:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABA:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABM:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABP:user/release-keys, and TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABS:user/release-keys). This malicious app reads from the "persist.sys.tctPowerIccid" system property to indirectly obtain the ICCID.
Published 2024-04-22 15:15:47
Updated 2024-07-03 01:40:46
Source MITRE
View at NVD,   CVE.org

Products affected by CVE-2023-38296

Please log in to view affected product information.

Exploit prediction scoring system (EPSS) score for CVE-2023-38296

0.04%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 9 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-38296

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
8.0
HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2.1
5.9
134c704f-9b21-4f2e-91b3-4a467353bcc0 2024-07-03

CWE ids for CVE-2023-38296

  • The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
    Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
  • A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
    Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
  • The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
    Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!