CVE-2023-42468

Summary

CVE-2023-42468 is a vulnerability affecting the com.cutestudio.colordialer application on Android versions up to 2.1.8-2. This issue allows a remote attacker to initiate phone calls without user consent, due to inadequate export control of the com.cutestudio.dialer.activities.DialerActivity component. Malicious third-party apps, without any required permissions, can exploit this flaw by crafting an intent targeting the vulnerable component via the android.intent.action.CALL action and a tel: URI, consequently placing a phone call without the user's interaction.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.