CVE-2023-38292 Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmen
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2023-38292?
CVE-2023-38292 is a high-severity vulnerability in n/a, published on 22 Apr 2024.
Official description
Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenuproxy (versionCode='2', versionName='v11.0.1.0.0201.0') that allows local third-party apps to programmatically perform a factory reset due to inadequate access control. No permissions or special privileges are necessary to exploit the vulnerability in the com.tct.gcs.hiddenmenuproxy app. No user interaction is required beyond installing and running a third-party app. The software build fingerprints for each confirmed vulnerable build are as follows: TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB7I-0:user/release-keys and TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB83-0:user/release-keys. This malicious app sends a broadcast intent to the exported com.tct.gcs.hiddenmenuproxy/.rtn.FactoryResetReceiver receiver component, which initiates a programmatic factory reset.
Weakness: CWE-269
Which versions are affected by CVE-2023-38292?
How do I fix CVE-2023-38292?
No fix has been published for CVE-2023-38292 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38292 being exploited?
There is no known exploitation of CVE-2023-38292 in the wild and no public exploit code.
Sources
Also known as GHSA-59xw-4jqj-crwp.