Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2024-53701

Severity CVSS v4.0:
Pending analysis
Type:
CWE-306 Missing Authentication for Critical Function
Publication date:
29/11/2024
Last modified:
29/11/2024

Description

Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc.<br /> Under certain conditions, and when an attacker can directly operate the device which its screen is unlocked by a user, the provided security features&amp;#39; setting pages may be exposed and/or the settings may be altered, without authentication. For example, specific applications in the device configured to be hidden may be displayed and/or activated.

Impact

Vector 3.x
CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 3.10 LOW
Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector (AV): Physical
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): Low
Integrity (I): Low
Availability (A): None

Base Score 3.x
3.10
Severity 3.x
LOW

References to Advisories, Solutions, and Tools