CVE-2023-25647 - Vulnerability Details

Vendors	Products
Zte	Axon 30 Axon 30 Firmware Axon 40 Pro Axon 40 Pro Firmware Axon 40 Ultra Axon 40 Ultra Firmware Nubia Z50 Nubia Z50 Firmware

Link	Providers
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-25647", "assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb", "state": "PUBLISHED", "assignerShortName": "zte", "dateReserved": "2023-02-09T19:47:48.022Z", "datePublished": "2023-08-17T02:13:19.932Z", "dateUpdated": "2024-10-01T18:17:44.385Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Android"], "product": "Some ZTE Mobile Phones", "vendor": "ZTE", "versions": [{"lessThanOrEqual": "V1.0.0B07", "status": "affected", "version": "NON_EEA_P870F21V1.0.0B01", "versionType": "V1.0.0B07"}, {"lessThanOrEqual": "V1.0.0B18MR", "status": "affected", "version": " GEN_ZTE_PQ82A01V1.0.0B01MR", "versionType": "V1.0.0B18MR"}, {"lessThanOrEqual": "V3.0.0B05", "status": "affected", "version": "GEN_ZTE_P870A01V3.0.0B01", "versionType": "V3.0.0B05"}, {"lessThanOrEqual": "V2.0.0B16", "status": "affected", "version": "GEN_ZTE_P898A01V2.0.0B01", "versionType": "V2.0.0B16"}]}], "datePublic": "2023-07-27T02:10:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n\n\n<span style=\"background-color: rgb(255, 255, 255);\">T</span><span style=\"background-color: rgb(255, 255, 255);\">here is a permission and access control vulnerability in some ZTE mobile phones. Due to </span><span style=\"background-color: rgb(255, 255, 255);\">improper access control</span><span style=\"background-color: rgb(255, 255, 255);\">, </span><span style=\"background-color: rgb(255, 255, 255);\">applications in mobile phone c</span><span style=\"background-color: rgb(255, 255, 255);\">ould</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">monitor</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">the touch</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;event.</span>\n\n\n\n"}], "value": "\n\n\nThere is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could\u00a0monitor\u00a0the touch\u00a0event.\n\n\n\n"}], "impacts": [{"capecId": "CAPEC-554", "descriptions": [{"lang": "en", "value": "CAPEC-554 Functionality Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6786b568-6808-4982-b61f-398b0d9679eb", "shortName": "zte", "dateUpdated": "2023-08-30T00:56:20.949Z"}, "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264"}], "source": {"discovery": "EXTERNAL"}, "title": "Permission and Access Control Vulnerability in Some ZTE Mobile Phones", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:25:19.245Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-01T18:11:54.039790Z", "id": "CVE-2023-25647", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T18:17:44.385Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-25647 (string)

assignerOrgId : 6786b568-6808-4982-b61f-398b0d9679eb (string)

state : PUBLISHED (string)

assignerShortName : zte (string)

dateReserved : 2023-02-09T19:47:48.022Z (string)

datePublished : 2023-08-17T02:13:19.932Z (string)

dateUpdated : 2024-10-01T18:17:44.385Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : Android (string)

]

product : Some ZTE Mobile Phones (string)

vendor : ZTE (string)

versions : [ »

0 : { »

lessThanOrEqual : V1.0.0B07 (string)

status : affected (string)

version : NON_EEA_P870F21V1.0.0B01 (string)

versionType : V1.0.0B07 (string)

}

1 : { »

lessThanOrEqual : V1.0.0B18MR (string)

status : affected (string)

version : GEN_ZTE_PQ82A01V1.0.0B01MR (string)

versionType : V1.0.0B18MR (string)

}

2 : { »

lessThanOrEqual : V3.0.0B05 (string)

status : affected (string)

version : GEN_ZTE_P870A01V3.0.0B01 (string)

versionType : V3.0.0B05 (string)

}

3 : { »

lessThanOrEqual : V2.0.0B16 (string)

status : affected (string)

version : GEN_ZTE_P898A01V2.0.0B01 (string)

versionType : V2.0.0B16 (string)

}

]

}

]

datePublic : 2023-07-27T02:10:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event. (string)

}

]

value : There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-554 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-554 Functionality Bypass (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-269 (string)

description : CWE-269 Improper Privilege Management (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 6786b568-6808-4982-b61f-398b0d9679eb (string)

shortName : zte (string)

dateUpdated : 2023-08-30T00:56:20.949Z (string)

}

references : [ »

0 : { »

url : https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264 (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

title : Permission and Access Control Vulnerability in Some ZTE Mobile Phones (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T11:25:19.245Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-01T18:11:54.039790Z (string)

id : CVE-2023-25647 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-01T18:17:44.385Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:25:19.245Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-25647", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-01T18:11:54.039790Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T18:17:31.645Z"}}], "cna": {"title": "Permission and Access Control Vulnerability in Some ZTE Mobile Phones", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-554", "descriptions": [{"lang": "en", "value": "CAPEC-554 Functionality Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ZTE", "product": "Some ZTE Mobile Phones", "versions": [{"status": "affected", "version": "NON_EEA_P870F21V1.0.0B01", "versionType": "V1.0.0B07", "lessThanOrEqual": "V1.0.0B07"}, {"status": "affected", "version": " GEN_ZTE_PQ82A01V1.0.0B01MR", "versionType": "V1.0.0B18MR", "lessThanOrEqual": "V1.0.0B18MR"}, {"status": "affected", "version": "GEN_ZTE_P870A01V3.0.0B01", "versionType": "V3.0.0B05", "lessThanOrEqual": "V3.0.0B05"}, {"status": "affected", "version": "GEN_ZTE_P898A01V2.0.0B01", "versionType": "V2.0.0B16", "lessThanOrEqual": "V2.0.0B16"}], "platforms": ["Android"], "defaultStatus": "unaffected"}], "datePublic": "2023-07-27T02:10:00.000Z", "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\n\n\nThere is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could\u00a0monitor\u00a0the touch\u00a0event.\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n\n\n<span style=\"background-color: rgb(255, 255, 255);\">T</span><span style=\"background-color: rgb(255, 255, 255);\">here is a permission and access control vulnerability in some ZTE mobile phones. Due to </span><span style=\"background-color: rgb(255, 255, 255);\">improper access control</span><span style=\"background-color: rgb(255, 255, 255);\">, </span><span style=\"background-color: rgb(255, 255, 255);\">applications in mobile phone c</span><span style=\"background-color: rgb(255, 255, 255);\">ould</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">monitor</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">the touch</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;event.</span>\n\n\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "6786b568-6808-4982-b61f-398b0d9679eb", "shortName": "zte", "dateUpdated": "2023-08-30T00:56:20.949Z"}}}, "cveMetadata": {"cveId": "CVE-2023-25647", "state": "PUBLISHED", "dateUpdated": "2024-10-01T18:17:44.385Z", "dateReserved": "2023-02-09T19:47:48.022Z", "assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb", "datePublished": "2023-08-17T02:13:19.932Z", "assignerShortName": "zte"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T11:25:19.245Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-25647 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-01T18:11:54.039790Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-01T18:17:31.645Z (string)

}

]

cna : { »

title : Permission and Access Control Vulnerability in Some ZTE Mobile Phones (string)

source : { »

discovery : EXTERNAL (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-554 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-554 Functionality Bypass (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.7 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : REQUIRED (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : ZTE (string)

product : Some ZTE Mobile Phones (string)

versions : [ »

0 : { »

status : affected (string)

version : NON_EEA_P870F21V1.0.0B01 (string)

versionType : V1.0.0B07 (string)

lessThanOrEqual : V1.0.0B07 (string)

}

1 : { »

status : affected (string)

version : GEN_ZTE_PQ82A01V1.0.0B01MR (string)

versionType : V1.0.0B18MR (string)

lessThanOrEqual : V1.0.0B18MR (string)

}

2 : { »

status : affected (string)

version : GEN_ZTE_P870A01V3.0.0B01 (string)

versionType : V3.0.0B05 (string)

lessThanOrEqual : V3.0.0B05 (string)

}

3 : { »

status : affected (string)

version : GEN_ZTE_P898A01V2.0.0B01 (string)

versionType : V2.0.0B16 (string)

lessThanOrEqual : V2.0.0B16 (string)

}

]

platforms : [ »

0 : Android (string)

]

defaultStatus : unaffected (string)

}

]

datePublic : 2023-07-27T02:10:00.000Z (string)

references : [ »

0 : { »

url : https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264 (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-269 (string)

description : CWE-269 Improper Privilege Management (string)

}

]

}

]

providerMetadata : { »

orgId : 6786b568-6808-4982-b61f-398b0d9679eb (string)

shortName : zte (string)

dateUpdated : 2023-08-30T00:56:20.949Z (string)

}

cveMetadata : { »

cveId : CVE-2023-25647 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-01T18:17:44.385Z (string)

dateReserved : 2023-02-09T19:47:48.022Z (string)

assignerOrgId : 6786b568-6808-4982-b61f-398b0d9679eb (string)

datePublished : 2023-08-17T02:13:19.932Z (string)

assignerShortName : zte (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:axon_30_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B7C570B-450A-46EF-BE44-C9080D843A58", "versionEndExcluding": "3.0.0b06", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:axon_30:-:*:*:*:*:*:*:*", "matchCriteriaId": "F2F14440-A165-43E7-BDA7-EC4C9C95123E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:axon_40_pro_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BE9D395-28E9-4618-90AC-389D57EFC0BE", "versionEndExcluding": "1.0.0b16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:axon_40_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "3A9FA4EE-82AA-4C53-A084-7B7286361253", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:axon_40_ultra_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3D7BB985-80B3-49A2-8AE4-6077CB394328", "versionEndExcluding": "2.0.0b17", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:axon_40_ultra:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C9F41AC-BCE6-416B-B11F-D86769525F9D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:nubia_z50_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5372F382-E1BF-4446-A2FE-679951C97FA1", "versionEndExcluding": "1.0.0b19mr", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:nubia_z50:-:*:*:*:*:*:*:*", "matchCriteriaId": "34767307-B629-4BE7-8530-F604BF5BF459", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "\n\n\nThere is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could\u00a0monitor\u00a0the touch\u00a0event.\n\n\n\n"}], "id": "CVE-2023-25647", "lastModified": "2024-11-21T07:49:51.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "psirt@zte.com.cn", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-17T03:15:09.003", "references": [{"source": "psirt@zte.com.cn", "tags": ["Vendor Advisory"], "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264"}], "sourceIdentifier": "psirt@zte.com.cn", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "psirt@zte.com.cn", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:zte:axon_30_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6B7C570B-450A-46EF-BE44-C9080D843A58 (string)

versionEndExcluding : 3.0.0b06 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:zte:axon_30:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F2F14440-A165-43E7-BDA7-EC4C9C95123E (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:zte:axon_40_pro_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6BE9D395-28E9-4618-90AC-389D57EFC0BE (string)

versionEndExcluding : 1.0.0b16 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:zte:axon_40_pro:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 3A9FA4EE-82AA-4C53-A084-7B7286361253 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:zte:axon_40_ultra_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 3D7BB985-80B3-49A2-8AE4-6077CB394328 (string)

versionEndExcluding : 2.0.0b17 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:zte:axon_40_ultra:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 3C9F41AC-BCE6-416B-B11F-D86769525F9D (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

3 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:zte:nubia_z50_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 5372F382-E1BF-4446-A2FE-679951C97FA1 (string)

versionEndExcluding : 1.0.0b19mr (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:zte:nubia_z50:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 34767307-B629-4BE7-8530-F604BF5BF459 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event. (string)

}

]

id : CVE-2023-25647 (string)

lastModified : 2024-11-21T07:49:51.750 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1 (number)

impactScore : 3.6 (number)

source : psirt@zte.com.cn (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 3.3 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-08-17T03:15:09.003 (string)

references : [ »

0 : { »

source : psirt@zte.com.cn (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264 (string)

}

]

sourceIdentifier : psirt@zte.com.cn (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-269 (string)

}

]

source : psirt@zte.com.cn (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-863 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object