Security Resilience

CVE-2023-41824

Published
03 May 2024
Modified
15 April 2026
CVSS Score v3.1 2.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS Score 0.0014 3th percentile
Risk Priority 24 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-41824 is a low-severity Use of Implicit Intent for Sensitive Communication (CWE-927) vulnerability in Motorola Phone Calls (inferred from references). Its CVSS base score is 2.8 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data.

CWE(s)
CWE-927

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-3108Shared CWE-927
CVE-2023-44127Shared CWE-927
CVE-2023-47889Shared CWE-927
CVE-2023-41826Shared CWE-927
CVE-2023-41817Shared CWE-927
CVE-2023-41820Shared CWE-927
CVE-2024-3480Shared CWE-927
CVE-2023-41828Shared CWE-927
CVE-2023-31014Shared CWE-927

Affected Assets

Motorola
Phone Calls
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement partial match

Enforces explicit authorization decisions on which apps may receive sensitive data, directly stopping implicit-intent broadcast.

AC-4 Information Flow Enforcement partial match

Requires approved information-flow rules between components, which implicit intents for sensitive data violate.

SC-8 Transmission Confidentiality and Integrity partial match

Protects confidentiality of transmitted data even if an unintended receiver obtains the intent.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly prohibit implicit intents for sensitive data while this single CWE addresses only one narrow coding rule.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.26 Response to information security incidents partial match
removes
A.8.12 Data leakage prevention partial match
degrades

DLP policies and technical controls directly prevent sensitive data from leaving via insecure implicit intents.

A.8.20 Networks security partial match
degrades

Network security rules can restrict inter-app communication channels that implicit intents rely on.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including resilience against injections or input controls) be identified and specified during development; it does not itself enforce, implement or configure any mechanism that stops an implicit Intent from being used or exploited for sensitive data.

A.8.27 Secure system architecture and engineering principles partial match
blocks

A.8.27 mandates establishing and applying secure engineering principles (including least privilege, security by design, distrust external input, and hardening) during the SDLC; while these principles could guide developers away from implicit intents, the control itself does not stop the resulting weakness from remaining present and exploitable in an already-built Android app.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly forbid implicit intents when handling sensitive information.

References