CVE-2023-25647

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-269CWE-863

Affected software

VendorProductVersions
ZTESome ZTE Mobile Phones>= NON_EEA_P870F21V1.0.0B01, <= V1.0.0B07; >= GEN_ZTE_PQ82A01V1.0.0B01MR, <= V1.0.0B18MR; >= GEN_ZTE_P870A01V3.0.0B01, <= V3.0.0B05; >= GEN_ZTE_P898A01V2.0.0B01, <= V2.0.0B16

References

Timeline

Published
Aug 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-256487.8There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary userCVE-2023-256498.8There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface pCVE-2023-25656.1A vulnerability has been found in SourceCodester Multi Language Hotel Management Software 1.0 and classified as problematic. This vulnerabilCVE-2023-256506.5There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an aCVE-2023-256518.0There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameterCVE-2023-256527.5Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40CVE-2023-256537.5node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior CVE-2023-256549.8baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management systCVE-2023-256559.8baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.CVE-2023-256567.5notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3,CVE-2023-256579.8Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a rCVE-2023-256587.5TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, an out of bounds read is in GRUBlockCellGra
CVE-2023-25647: Low severity, CVSS 3.3 | Vulnix