CVE-2023-44121: LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.notification.ACTION". Additionally, this vulnerability is very dangerous because LG ThinQ Service is a system app (having android:sharedUserId="android.uid.system" setting). Intent redirection in this app leads to accessing arbitrary not exported activities of absolutely all apps.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-44121.
What is the severity of CVE-2023-44121?
The severity of CVE-2023-44121 is medium with a severity value of 6.3.
Which software is affected by CVE-2023-44121?
The software affected by CVE-2023-44121 includes Google Android versions 9.0 to 13.0 and LG V60 Thin Q 5g.
How can the vulnerability CVE-2023-44121 be exploited?
The vulnerability CVE-2023-44121 can be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.n…
Where can I find more information about CVE-2023-44121?
More information about CVE-2023-44121 can be found at https://lgsecurity.lge.com/bulletins/mobile#updateDetails.