« Back to list

CVE-2023-44127

Status: ModifiedMedium (5.5)—

he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Google — Android

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2023-44127",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-44127",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-20T18:14:19.419341Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "product.security@lge.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 3.6,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "product.security@lge.com",
      "affectedData": [
        {
          "vendor": "LG Electronics",
          "product": "LG V60 Thin Q 5G(LMV600VM)",
          "versions": [
            {
              "status": "affected",
              "version": "Android 8",
              "versionType": "Android",
              "lessThanOrEqual": "13"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-09-27T15:19:37.067",
  "references": [
    {
      "url": "https://lgsecurity.lge.com/bulletins/mobile#updateDetails",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product.security@lge.com"
    },
    {
      "url": "https://lgsecurity.lge.com/bulletins/mobile#updateDetails",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product.security@lge.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-927"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "he vulnerability is that the Call management (\"com.android.server.telecom\") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad es que la aplicación de administración de Llamadas (\"com.android.server.telecom\") parcheada por LG lanza intenciones implícitas que revelan datos sensibles a todas las aplicaciones de terceros instaladas en el mismo dispositivo. Esas intenciones incluyen datos como detalles de contacto y números de teléfono."
    }
  ],
  "lastModified": "2026-06-17T06:26:58.430",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4E21776-A17F-44D5-AF8F-4BC3806BE6B4",
              "versionEndIncluding": "13.0",
              "versionStartIncluding": "8.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lg:v60_thin_q_5g:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "85B3B7D2-762E-4DD5-90F9-5246907748C4"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "product.security@lge.com"
}