Security readout for executives and security teams
Plain-English summary
This CVE affects certain Unisoc-based Android devices. A missing telephony-service permission check could let someone with local app or device access read information they should not access. The sources do not provide severity scoring, patch level details, or evidence of active exploitation.
Executive priority
Track this as a mobile fleet exposure item rather than an emergency based on current evidence. Prioritize identifying affected Unisoc devices and obtaining OEM update guidance.
Technical view
CVE-2023-33881 is a local information disclosure issue in the telephony service caused by a missing permission check. The affected list names multiple Unisoc chipsets/platforms on Android 10 through Android 13. Public sources do not include CVSS, CWE, detailed attack prerequisites, fixed versions, or validation indicators.
Likely exposure
Exposure appears limited to devices using the listed Unisoc platforms running Android 10, 11, 12, or 13. Confirm by hardware inventory, OEM firmware data, and mobile device management records.
Exploitation context
The source bundle says local information disclosure with no additional execution privileges needed. It does not state remote exploitability, public exploit availability, or active exploitation. KEV status is false.
Researcher notes
Evidence is sparse. The public record identifies a missing telephony-service permission check and local information disclosure, but omits CVSS, CWE, patch identifiers, proof-of-concept status, and concrete affected firmware ranges beyond platform and Android versions.
Mitigation direction
- Inventory managed Android devices for the listed Unisoc platforms and Android versions.
- Check Unisoc and device OEM guidance for fixed firmware or security updates.
- Prioritize updates for devices handling sensitive calls, messages, or enterprise communications.
- Limit use of unmanaged apps on potentially affected devices until vendor guidance is confirmed.
Validation and detection
- Confirm device SoC model and Android version from MDM or OEM inventory data.
- Compare firmware build and security patch level against Unisoc or OEM advisories.
- Review mobile fleet for devices matching SC9863A, SC9832E, SC7731E, T-series, or S8000 entries.
- Document unsupported or unpatchable affected devices for risk acceptance or replacement decisions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-33881 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.