Technical impact
A logic error in multiple functions of btm_sec.cc allows an attacker to intercept SMS messages. The flaw, categorized as CWE-693, can lead to remote disclosure of sensitive information without requiring elevated execution privileges. User interaction is required for exploitation, meaning the victim must grant or enable a feature that permits the attacker to read SMS data.
Affected Systems
The vulnerability affects Android devices provided by Google. Specific affected Android versions are not listed in the provided data, and no CPE strings are available.
Risk and Exploitability
The CVSS score is 4.3, indicating a low severity, and the EPSS score is below 1%, reflecting a very low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The attack likely stems from a local flaw that requires the user to interact with the system or accept a permission, so an attacker would need to trick the victim into enabling the interception path. Overall, the risk to information confidentiality is moderate but limited by the need for user involvement.
