CVE-2023-38292: High severity Tcl com.tct.gcs.hiddenmenuproxy vulnerability
Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenuproxy (versionCode='2', versionName='v11.0.1.0.0201.0') that allows local third-party apps to programmatically perform a factory reset due to inadequate access control. No permissions or special privileges are necessary to exploit the vulnerability in the com.tct.gcs.hiddenmenuproxy app. No user interaction is required beyond installing and running a third-party app. The software build fingerprints for each confirmed vulnerable build are as follows: TCL/5087ZBO/DohaTMO:11/RP1A.200720.011/PB7I-0:user/release-keys and TCL/5087ZBO/DohaTMO:11/RP1A.200720.011/PB83-0:user/release-keys. This malicious app sends a broadcast intent to the exported com.tct.gcs.hiddenmenuproxy/.rtn.FactoryResetReceiver receiver component, which initiates a programmatic factory reset.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-38292?
CVE-2023-38292 is considered a critical vulnerability due to its potential to allow local third-party applications to perform unauthorized factory resets.
How do I fix CVE-2023-38292?
To fix CVE-2023-38292, users should update their TCL 20XE Android device to the latest software version provided by the manufacturer.
Which devices are affected by CVE-2023-38292?
CVE-2023-38292 specifically affects the TCL 20XE Android device that contains the vulnerable app com.tct.gcs.hiddenmenuproxy.
What are the implications of CVE-2023-38292?
The implications of CVE-2023-38292 include the risk of unauthorized data loss and device reset, compromising user security and privacy.
Is CVE-2023-38292 being actively exploited?
As of now, there are no confirmed reports of active exploitation for CVE-2023-38292, but the vulnerability remains a serious risk.