CVE-2023-25645

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-25645", "assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb", "assignerShortName": "zte", "dateUpdated": "2024-12-12T17:14:29.564Z", "dateReserved": "2023-02-09T00:00:00.000Z", "datePublished": "2023-06-16T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "6786b568-6808-4982-b61f-398b0d9679eb", "shortName": "zte", "dateUpdated": "2023-06-16T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and applications on the user's device, affecting device operation."}], "affected": [{"vendor": "n/a", "product": "UP T2 4K, ZXV10 B866V2-H, ZXV10 B866V2, ZXV10 B860H V5D0, ZXV10 B866V2F", "versions": [{"version": "V84511302.1427,V84711321.0038,V84711321.0040,V84711321.0045,V84711321.0049,V82811306.3021,V84711309.0016,V84711309.0018,V84711309.0019,V82815416.1027,V82815416.1028,V82815416.1029,V82815416.2012,V83011303.0049,V83011303.0051,V83011303.0053,V83011303.0063,V83011303.0069,V86111338.0026,V86111338.0031,V86111338.0033,V86111338.0035", "status": "affected"}]}], "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "permission and access control"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:25:19.247Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-276", "lang": "en", "description": "CWE-276 Incorrect Default Permissions"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-12T17:13:24.538558Z", "id": "CVE-2023-25645", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-12T17:14:29.564Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:25:19.247Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-25645", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-12T17:13:24.538558Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-12T17:12:43.334Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "UP T2 4K, ZXV10 B866V2-H, ZXV10 B866V2, ZXV10 B860H V5D0, ZXV10 B866V2F", "versions": [{"status": "affected", "version": "V84511302.1427,V84711321.0038,V84711321.0040,V84711321.0045,V84711321.0049,V82811306.3021,V84711309.0016,V84711309.0018,V84711309.0019,V82815416.1027,V82815416.1028,V82815416.1029,V82815416.2012,V83011303.0049,V83011303.0051,V83011303.0053,V83011303.0063,V83011303.0069,V86111338.0026,V86111338.0031,V86111338.0033,V86111338.0035"}]}], "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464"}], "descriptions": [{"lang": "en", "value": "There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and applications on the user's device, affecting device operation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "permission and access control"}]}], "providerMetadata": {"orgId": "6786b568-6808-4982-b61f-398b0d9679eb", "shortName": "zte", "dateUpdated": "2023-06-16T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2023-25645", "state": "PUBLISHED", "dateUpdated": "2024-12-12T17:14:29.564Z", "dateReserved": "2023-02-09T00:00:00.000Z", "assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb", "datePublished": "2023-06-16T00:00:00.000Z", "assignerShortName": "zte"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "UP T2 4K, ZXV10 B866V2-H, ZXV10 B866V2, ZXV10 B860H V5D0, ZXV10 B866V2F", "vendor": "n/a", "versions": [{"status": "affected", "version": "V84511302.1427,V84711321.0038,V84711321.0040,V84711321.0045,V84711321.0049,V82811306.3021,V84711309.0016,V84711309.0018,V84711309.0019,V82815416.1027,V82815416.1028,V82815416.1029,V82815416.2012,V83011303.0049,V83011303.0051,V83011303.0053,V83011303.0063,V83011303.0069,V86111338.0026,V86111338.0031,V86111338.0033,V86111338.0035"}]}], "source": "psirt@zte.com.cn"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:up_t2_4k_firmware:v84511302.1427:*:*:*:*:*:*:*", "matchCriteriaId": "7A170ABC-EAA7-40D1-896C-DAD16C8D7260", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:up_t2_4k:-:*:*:*:*:*:*:*", "matchCriteriaId": "FF5A786F-6CC1-489B-9F5F-CACE8E330A51", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:zxv10_b866v2-h_firmware:v84711321.0038:*:*:*:*:*:*:*", "matchCriteriaId": "23D6C7DB-D959-473D-BBA5-B096EDCBE338", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2-h_firmware:v84711321.0040:*:*:*:*:*:*:*", "matchCriteriaId": "966CA470-382E-4441-AB66-612B7B13BAD8", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2-h_firmware:v84711321.0045:*:*:*:*:*:*:*", "matchCriteriaId": "3E9A54F0-6C6A-4D6D-971F-CCB00EBE0EF0", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2-h_firmware:v84711321.0049:*:*:*:*:*:*:*", "matchCriteriaId": "F0917421-77D0-4570-93EB-20E43BE956FC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:zxv10_b866v2-h:-:*:*:*:*:*:*:*", "matchCriteriaId": "E91F392B-2958-45B3-917F-5DCEDE09D57A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:zxv10_b866v2_firmware:v82811306.3021:*:*:*:*:*:*:*", "matchCriteriaId": "B0CE2F78-3030-4ED6-801E-A0921BFFAE93", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2_firmware:v82815416.1027:*:*:*:*:*:*:*", "matchCriteriaId": "2F181A93-93A7-4866-BA9B-837CBC2EFFF8", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2_firmware:v82815416.1028:*:*:*:*:*:*:*", "matchCriteriaId": "CF7CEFFF-CDB8-4BA7-95F7-E131B77B9891", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2_firmware:v82815416.1029:*:*:*:*:*:*:*", "matchCriteriaId": "1E57517D-2A2F-416A-A2A0-BCF8435D6F63", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2_firmware:v82815416.2012:*:*:*:*:*:*:*", "matchCriteriaId": "85272C45-5AD6-43A4-80E0-78B796940FB4", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2_firmware:v84711309.0016:*:*:*:*:*:*:*", "matchCriteriaId": "D5B74E25-442D-486D-98FD-383B2ED3989F", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2_firmware:v84711309.0018:*:*:*:*:*:*:*", "matchCriteriaId": "9C15F806-081C-4575-860D-B087D23BD6A8", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2_firmware:v84711309.0019:*:*:*:*:*:*:*", "matchCriteriaId": "F374A943-A473-415C-BBDE-DBBEF0E07BF4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:zxv10_b866v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "1F37D926-BA5B-4081-97C4-B8B87D90D9BD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0049:*:*:*:*:*:*:*", "matchCriteriaId": "AA1243D2-F92D-4C57-9AA0-2AB6B07BA381", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0051:*:*:*:*:*:*:*", "matchCriteriaId": "D79ABA22-FCDD-465A-9DB4-599341370D75", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0053:*:*:*:*:*:*:*", "matchCriteriaId": "6DAA0753-52FA-4FEA-8388-66D80E17E443", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0063:*:*:*:*:*:*:*", "matchCriteriaId": "B5270126-8727-41F0-B7BA-4707A9E955EB", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0069:*:*:*:*:*:*:*", "matchCriteriaId": "57A8F5A1-C8FA-4AE9-B72C-461E91C01803", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:zxv10_b860h_v5d0:-:*:*:*:*:*:*:*", "matchCriteriaId": "1FE5EFFC-3198-4449-876D-BF28E5161454", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:zxv10_b866v2f_firmware:v86111338.0026:*:*:*:*:*:*:*", "matchCriteriaId": "8FBE4772-CFC5-446A-8145-0A01C6056151", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2f_firmware:v86111338.0031:*:*:*:*:*:*:*", "matchCriteriaId": "AC5A0349-1394-4B46-9F86-DE5D761CAED4", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2f_firmware:v86111338.0033:*:*:*:*:*:*:*", "matchCriteriaId": "28F830CA-2318-420A-9E8B-6B7A8CDFD56B", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxv10_b866v2f_firmware:v86111338.0035:*:*:*:*:*:*:*", "matchCriteriaId": "8175D049-DEFB-4234-9E80-67328E3D3418", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:zxv10_b866v2f:-:*:*:*:*:*:*:*", "matchCriteriaId": "39271F84-DD7F-4A5B-B907-F7712F31EAAB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and applications on the user's device, affecting device operation."}], "id": "CVE-2023-25645", "lastModified": "2026-06-17T05:41:38.883", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-25645", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-12-12T17:13:24.538558Z", "version": "2.0.3"}}]}, "published": "2023-06-16T19:15:14.527", "references": [{"source": "psirt@zte.com.cn", "tags": ["Vendor Advisory"], "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464"}], "sourceIdentifier": "psirt@zte.com.cn", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-276"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}