Security readout for executives and security teams
Plain-English summary
Some Unisoc Android device chipsets had a missing permission check in the telephony service. A local app or local actor could gain information that should have been protected, without needing extra privileges. The public record does not provide impact detail, CVSS score, named patch level, or evidence of exploitation.
Executive priority
Set priority based on device presence and sensitivity. This is not documented as actively exploited in the supplied sources, but local information disclosure in telephony components matters for fleets handling sensitive communications. Inventory first, then patch or replace exposed devices through OEM-supported channels.
Technical view
CVE-2023-30935 is a local information disclosure issue in the Unisoc telephony service caused by a missing permission check. The affected listing covers multiple Unisoc chipsets running Android 10 through Android 13. No CWE, CVSS vector, exploit detail, or concrete remediation version is included in the provided sources.
Likely exposure
Exposure is most likely in Android devices using the listed Unisoc chipsets: SC9863A, SC9832E, SC7731E, T310, T606, T610, T612, T616, T618, T760, T770, T820, and S8000 on Android 10 to 13.
Exploitation context
The sources describe local information disclosure with no additional execution privileges needed. They do not state remote exploitability, active exploitation, public exploit availability, or inclusion in CISA KEV. Treat exploitation status as unconfirmed unless vendor or threat intelligence updates say otherwise.
Researcher notes
Evidence is sparse: the CVE record identifies the component, weakness type in prose, local impact, affected chipsets, and Android version range. It does not provide affected build fingerprints, fixed versions, patch identifiers, root cause detail, or exploit conditions beyond local information disclosure.
Mitigation direction
- Check Unisoc and device OEM advisories for the corrected firmware or Android security update.
- Prioritize updates for managed devices using affected Unisoc chipsets and Android 10 through 13.
- Restrict installation of untrusted apps on potentially affected devices until vendor guidance is confirmed.
- Monitor mobile EDR, MDM, and helpdesk signals for suspicious local app behavior.
Validation and detection
- Inventory Android device models and map them to Unisoc chipset and Android version.
- Confirm whether each device has received the relevant OEM or Unisoc security update.
- Review MDM compliance data for outdated Android 10 through 13 devices using affected chipsets.
- Document devices that cannot be patched and apply compensating controls or replacement planning.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-30935 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.