CVE-2024-53931

Critical

Published: 06 January 2025

Published

06 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0014 32.9th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-53931 is a critical-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability. Its CVSS base score is 9.1 (Critical).

Operationally, ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations on the DialerActivity component to prevent unauthorized access via crafted intents from any application.

SI-10 Information Input Validation good match

prevent

Validates information inputs such as crafted intents to the DialerActivity, blocking malicious requests lacking proper permissions or structure.

AC-19 Access Control for Mobile Devices partial match

prevent

Enforces access controls and approved configurations for mobile device applications, restricting exposure of vulnerable components like DialerActivity.

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.

Confidence: LOW · MITRE ATT&CK Enterprise v18.1

NVD Description

The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.glitter.caller.screen.DialerActivity component.

Deeper analysisAI

CVE-2024-53931 affects the com.glitter.caller.screen application, also known as iCaller, Caller Theme & Dialer, for Android in versions through 1.1. The vulnerability resides in the com.glitter.caller.screen.DialerActivity component, which improperly handles intents, allowing any other application on the device to initiate phone calls without requiring permissions or user interaction by sending a crafted intent. This flaw is rated with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is associated with CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-922.

Any malicious application installed on the same Android device can exploit this vulnerability without privileges or user consent, enabling remote attackers to leverage it via a network-accessible vector such as a malicious app downloaded from untrusted sources. Successful exploitation allows the attacker to place arbitrary phone calls silently, potentially leading to high confidentiality and integrity impacts, such as incurring unauthorized charges through premium-rate calls or disrupting user communications.

Mitigation details and further analysis, including a proof-of-concept, are available in the GitHub repository at https://github.com/actuator/com.glitter.caller.screen/blob/main/CVE-2024-53931. Users should update the application beyond version 1.1 if a patch is available or uninstall it to prevent exploitation.