CVE-2023-21220

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264590585References: N/A

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published
Jun 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-212226.7In load_dt_data of storage.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of CVE-2023-212237.5In LPP_ConvertGNSS_DataBitAssistance of LPP_CommonUtil.c, there is a possible out of bounds read due to a missing bounds check. This could lCVE-2023-212247.5In ss_ProcessReturnResultComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a heap buffer overflow. This couldCVE-2023-212257.8there is a possible way to bypass the protected confirmation screen due to Failure to lock display power. This could lead to local escalatioCVE-2023-212267.5In SAEMM_RetrieveTaiList of SAEMM_ContextManagement.c, there is a possible out of bounds read due to an incorrect bounds check. This could lCVE-2023-212277.5In HTBLogKM of htbserver.c, there is a possible information disclosure due to log information disclosure. This could lead to local informatiCVE-2023-212289.8In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check. This could leCVE-2023-212297.8In registerServiceLocked of ManagedServices.java, there is a possible bypass of background activity launch restrictions due to an unsafe PenCVE-2023-21236.1The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leCVE-2023-212305.5In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi accesCVE-2023-212317.8In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exported or permission-pCVE-2023-212323.3In multiple locations, there is a possible way to retrieve sensor data without permissions due to a permissions bypass. This could lead to l
CVE-2023-21220: High severity, CVSS 7.5 | Vulnix