CVE-2023-38300 Information disclosure in n/a
A malicious local app can read system properties to obtain the device's IMEI and ICCID, bypassing Android privacy restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38300?
CVE-2023-38300 is a medium-severity vulnerability in n/a, published on 22 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A certain software build for the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys) leaks the IMEI and the ICCID to system properties that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in this instance they are leaked by a high-privilege process and can be obtained indirectly. This malicious app reads from the "persist.sys.verizon_test_plan_imei" system property to indirectly obtain the IMEI and reads the "persist.sys.verizon_test_plan_iccid" system property to obtain the ICCID.
Weakness: CWE-200
Which versions are affected by CVE-2023-38300?
How do I fix CVE-2023-38300?
No fix has been published for CVE-2023-38300 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38300 being exploited?
There is no known exploitation of CVE-2023-38300 in the wild and no public exploit code.
Sources
Also known as GHSA-fx8w-m7j5-9568.