CVE-2024-53934
Published: 06 January 2025
Summary
CVE-2024-53934 is a high-severity Improper Preservation of Permissions (CWE-281) vulnerability. Its CVSS base score is 7.7 (High).
Operationally, ranked at the 20.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-53934 is a vulnerability in the com.windymob.callscreen.ringtone.callcolor.colorphone Android application, also known as Color Phone Call Screen Themes, affecting versions through 1.1.2. The issue lies in the com.frovis.androidbase.call.DialerActivity component, which permits any other application to initiate phone calls without requiring permissions or user interaction by sending a crafted intent. Classified under CWE-281, it carries a CVSS v3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high impact on confidentiality and integrity.
A local attacker with no privileges can exploit this vulnerability with low attack complexity and no user interaction required. Any malicious application installed on the device can send the crafted intent to trigger unauthorized phone calls, allowing the attacker to make arbitrary calls on the victim's behalf without their knowledge or consent.
Advisories and additional details are documented in the following GitHub repositories: https://github.com/actuator/com.windymob.callscreen.ringtone.callcolor.colorphone and https://github.com/actuator/com.windymob.callscreen.ringtone.callcolor.colorphone/blob/main/CVE-2024-53934.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52196
Vulnerability details
The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.frovis.androidbase.call.DialerActivity component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations to prevent any application from accessing the DialerActivity to initiate unauthorized phone calls via crafted intents.
Identifies and restricts sensitive actions like placing phone calls that must require identification, authentication, or user interaction, directly countering the no-interaction exploit.
Limits system functionality to essentials by disabling or restricting unnecessary exported components like DialerActivity that allow unauthorized inter-app access.