Security readout for executives and security teams
Plain-English summary
CVE-2023-30939 is a UNISOC telephony-service flaw that could let a local actor access information they should not see. The public data does not provide a severity score, exploit details, or confirmed active exploitation, so urgency depends on whether managed devices use the listed UNISOC chipsets and Android versions.
Executive priority
Treat this as a targeted mobile-fleet exposure check, not a broad emergency. Escalate priority if the organization relies on affected UNISOC-based Android devices in sensitive roles or cannot obtain OEM firmware guidance.
Technical view
The CVE describes a missing permission check in the telephony service, leading to local information disclosure without additional execution privileges. The affected scope lists multiple UNISOC chipsets across Android 10, 11, 12, and 13. The sources do not identify the exact protected data, affected firmware builds, or a specific patch level.
Likely exposure
Organizations may be exposed if their Android device fleet includes the listed UNISOC chipsets running Android 10 through Android 13. Exposure is device- and firmware-dependent, and the provided sources do not identify OEM model names or build numbers.
Exploitation context
The bundle marks this CVE as not in CISA KEV, and no cited source states active exploitation. The issue is local, so exploitation would require access to a vulnerable device or local execution context. Public evidence does not describe practical exploitability or attacker tooling.
Researcher notes
Public details are sparse. The record states missing authorization in telephony service and local information disclosure, but omits CVSS, CWE, code paths, data classes, and fixed builds. Avoid assuming exploitability beyond the local disclosure described by the CVE.
Mitigation direction
- Inventory Android devices using the listed UNISOC chipsets and Android versions.
- Check UNISOC and OEM advisories for CVE-2023-30939 firmware guidance.
- Apply OEM firmware updates only when they explicitly address this CVE or related telephony fixes.
- Prioritize managed, shared, or high-sensitivity mobile devices for review.
- Use mobile device management controls to reduce untrusted local app exposure.
Validation and detection
- Confirm chipset, Android version, OEM model, and firmware build for managed devices.
- Map confirmed devices against the UNISOC affected chipset and Android-version list.
- Review OEM release notes for CVE-2023-30939 or telephony permission-check fixes.
- Verify updated devices report the expected firmware or security patch level.
- Document devices where OEM remediation guidance is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-30939 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.