Cyber Resilience

CVE-2023-47882

HighPublic PoC

Published: 27 December 2023

Published
27 December 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0017 37.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-47882 is a high-severity an unspecified weakness vulnerability in Kamivision Yi Iot. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 37.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.

CWE(s)
NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

The vulnerability enables remote arbitrary JavaScript execution in an Android app's WebViewActivity via implicit intent, facilitating exploitation of client applications (T1203) and abuse of the JavaScript interpreter within WebView (T1059.007).

Affected Assets

kamivision
yi iot
≤ 4.1.9_20231127

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References