CVE-2023-21641 Permissions, Privileges, and Access Controls in Display

Medium 6.6 Published 4 Jul 2023 Updated 24 Oct 2024

A non-privileged app can alter global system brightness, causing undesired behavior on Qualcomm Snapdragon Android devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-21641?

CVE-2023-21641 is a medium-severity vulnerability in Qualcomm Fastconnect 6900 Firmware, published on 4 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An app with non-privileged access can change global system brightness and cause undesired system behavior.

Weakness: CWE-264

Which versions are affected by CVE-2023-21641?

It affects 15 products.

Products include Qualcomm Fastconnect 6900 Firmware, Qualcomm Fastconnect 7800 Firmware, Qualcomm Qca6574au Firmware, Qualcomm Qca6696 Firmware, Qualcomm Sa6145p Firmware, Qualcomm Sa6150p Firmware and 9 more.

How do I fix CVE-2023-21641?

Apply the vendor's patch.

Is CVE-2023-21641 being exploited?

There is no known exploitation of CVE-2023-21641 in the wild and no public exploit code.

All Qualcomm Fastconnect 6900 Firmware vulnerabilities

Sources

Also known as 3261486, A-264422251, GHSA-6v47-rxr3-m26v, PUB-A-264422251.