CVE-2023-44121: LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere
First published: Wed Sep 27 2023(Updated: )
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.notification.ACTION". Additionally, this vulnerability is very dangerous because LG ThinQ Service is a system app (having android:sharedUserId="android.uid.system" setting). Intent redirection in this app leads to accessing arbitrary not exported activities of absolutely all apps.
Credit: product.security@lge.com product.security@lge.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | >=9.0<=13.0 | |
| Lg V60 Thin Q 5g |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-44121.
What is the severity of CVE-2023-44121?
The severity of CVE-2023-44121 is medium with a severity value of 6.3.
Which software is affected by CVE-2023-44121?
The software affected by CVE-2023-44121 includes Google Android versions 9.0 to 13.0 and LG V60 Thin Q 5g.
How can the vulnerability CVE-2023-44121 be exploited?
The vulnerability CVE-2023-44121 can be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.n…
Where can I find more information about CVE-2023-44121?
More information about CVE-2023-44121 can be found at https://lgsecurity.lge.com/bulletins/mobile#updateDetails.
- agent/author
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/event
- agent/tags
- agent/description
- agent/first-publish-date
- vendor/google
- canonical/google android
- version/google android/9.0
- version/google android/13.0
- vendor/lg
- canonical/lg v60 thin q 5g