CVE-2023-21428

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. The patch removes unused code.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	>= R(11), S(12), T(13), < SMR Jan-2023 Release 1

References

https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01Vendor Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01Vendor Advisory

Timeline

Published: Feb 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-214293.3Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.CVE-2023-21435.4The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vuln CVE-2023-214307.8An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR JAN-2023 Release CVE-2023-214313.3Improper input validation in Bixby Vision prior to version 3.7.70.17 allows attacker to access data of Bixby Vision.CVE-2023-214327.8Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the own CVE-2023-214337.8Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy S CVE-2023-214346.1Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching CVE-2023-214355.5Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory addr CVE-2023-214363.3Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID.CVE-2023-214375.5Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive inform CVE-2023-214382.4Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder.CVE-2023-214397.8Improper input validation vulnerability in UwbDataTxStatusEvent prior to SMR Feb-2023 Release 1 allows attackers to launch certain activitie