PT-2022-25078 · Unknown · Devicemanagement
CVE-2022-39885
·
Published
2022-11-09
·
Updated
2023-07-14
CVSS v3.1
5.9
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
DeviceManagement versions prior to SMR Nov-2022 Release 1
Description
The issue is related to an improper access control vulnerability in the BootCompletedReceiver CMCC component of DeviceManagement. This vulnerability allows a local attacker to access device information.
Recommendations
For versions prior to SMR Nov-2022 Release 1, update to SMR Nov-2022 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the BootCompletedReceiver CMCC component to minimize the risk of exploitation.
Fix
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Devicemanagement