CVE-2024-53701 Missing authorization in arrows N F-51C
Attackers with physical access to an unlocked FCNT Android device can bypass authentication to view or alter privacy mode settings, exposing hidden applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-53701?
CVE-2024-53701 is a low-severity missing authorization vulnerability in FCNT LLC arrows N F-51C, published on 29 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc. Under certain conditions, and when an attacker can directly operate the device which its screen is unlocked by a user, the provided security features' setting pages may be exposed and/or the settings may be altered, without authentication. For example, specific applications in the device configured to be hidden may be displayed and/or activated.
Weakness: CWE-306
Which versions are affected by CVE-2024-53701?
How do I fix CVE-2024-53701?
No fix has been published for CVE-2024-53701 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-53701 being exploited?
There is no known exploitation of CVE-2024-53701 in the wild and no public exploit code.
Sources
Also known as GHSA-pvjp-3rj2-p4ww.