Vulnerability · Published Feb 25, 2022 · Assigned by mitre
CVE-2022-23835
High 8.1
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Official description
The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READ_SMS permission, and reads an IMAP credentialing message that is (by design) not displayed to the victim within the AOSP SMS/MMS messaging application. (Often, the IMAP credentials are usable to listen to voice mail messages sent before the vulnerability was exploited, in addition to new ones.) NOTE: some vendors characterize this as not a "concrete and exploitable risk.
Affected products (as reported)
References
- https://gitlab.com/kop316/vvm-disclosure x_refsource_MISC
- https://www.kb.cert.org/vuls/id/383864 x_refsource_MISC