CVE-2021-39635

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-39635
ims_ex is a vendor system service used to manage VoLTE in unisoc devices,But it does not verify the caller's permissions,so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

9.4 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:N

Exploitability : 10.0 / Impact : 9.2

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact NONE

References
Link Resource
https://source.android.com/security/bulletin/2022-02-01 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
History

07 Nov 2023, 03:37

Type Values Removed Values Added
Summary ims_ex is a vendor system service used to manage VoLTE in unisoc devices?But it does not verify the caller's permissions?so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634 ims_ex is a vendor system service used to manage VoLTE in unisoc devices,But it does not verify the caller's permissions,so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634

15 Feb 2022, 18:07

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 9.4
v3 : 9.1
First Time Google
Google android
CPE cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
References (MISC) https://source.android.com/security/bulletin/2022-02-01 - (MISC) https://source.android.com/security/bulletin/2022-02-01 - Vendor Advisory
CWE CWE-276

11 Feb 2022, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-02-11 18:15

Updated : 2023-12-10 14:22

NVD link : CVE-2021-39635

Mitre link : CVE-2021-39635

CVE.ORG link : CVE-2021-39635

JSON object : View

Products Affected

google

  • android
CWE
CWE-276

Incorrect Default Permissions