CVE-2023-45844

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-458454.4Improper conditions check for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.20 may allow a privileged user to p CVE-2023-458465.5Incomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of CVE-2023-458477.5Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially cra CVE-2023-458499.8An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason CVE-2023-45858.8Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption CVE-2023-458518.8The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. CVE-2023-458529.8In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands vi CVE-2023-458539.8MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename,CVE-2023-458547.5A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd p CVE-2023-458557.5qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.CVE-2023-458569.8qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI.CVE-2023-458576.5An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-