CVE-2023-41824
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:NSummary
CVE-2023-41824 is a low-severity Use of Implicit Intent for Sensitive Communication (CWE-927) vulnerability in Motorola Phone Calls (inferred from references). Its CVSS base score is 2.8 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-46316
Vulnerability Data
An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces explicit authorization decisions on which apps may receive sensitive data, directly stopping implicit-intent broadcast.
Requires approved information-flow rules between components, which implicit intents for sensitive data violate.
Protects confidentiality of transmitted data even if an unintended receiver obtains the intent.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prohibit implicit intents for sensitive data while this single CWE addresses only one narrow coding rule.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect the weakness but does not itself prevent it at runtime.
DLP policies and technical controls directly prevent sensitive data from leaving via insecure implicit intents.
Network security rules can restrict inter-app communication channels that implicit intents rely on.
Application security requirements can mandate explicit intents or secure IPC for sensitive data.
Secure architecture principles discourage implicit intents for sensitive payloads.
Secure coding standards explicitly forbid implicit intents when handling sensitive information.