Security readout for executives and security teams
Plain-English summary
A Unisoc telephony service permission check is missing, allowing local information disclosure without extra execution privileges. Sources do not provide CVSS, detailed impact, or a named patch. The business concern is mainly Android devices using listed Unisoc chipsets on Android 10 through Android 13.
Executive priority
Treat this as a targeted mobile fleet hygiene issue, not an emergency based on current evidence. Prioritize visibility into Unisoc-based Android devices, vendor confirmation, and available firmware updates, especially where phones handle sensitive communications or regulated data.
Technical view
CVE-2023-33891 is a local information disclosure issue in the telephony service. The affected list names multiple Unisoc chipsets, including SC9863A, SC9832E, SC7731E, T310, T606, T610, T612, T616, T618, T760, T770, T820, and S8000 across Android 10, 11, 12, and 13.
Likely exposure
Exposure is limited to devices using the listed Unisoc chipsets and Android versions. Organizations should verify actual device models through asset inventory, MDM data, OEM bills of materials, or vendor support channels. The source bundle does not identify specific handset brands or models.
Exploitation context
The CVE describes local information disclosure, not remote compromise. CISA KEV status is false in the bundle, and no cited source states active exploitation. Evidence does not establish exploit maturity, public exploit availability, or real-world abuse.
Researcher notes
Public data is sparse: no CVSS vector, CWE, exploit detail, or explicit fix is present in the supplied bundle. Analysis should remain bounded to local information disclosure in Unisoc telephony service and the listed affected chipsets and Android versions.
Mitigation direction
- Check the Unisoc advisory and OEM guidance for firmware or security update availability.
- Prioritize updates for managed Android devices with listed Unisoc chipsets.
- Restrict installation of untrusted local apps where affected devices remain unpatched.
- Use MDM policy to monitor patch status and risky sideloading behavior.
- Ask device vendors whether their models include affected Unisoc components.
Validation and detection
- Inventory Android devices for Unisoc chipset model and Android version.
- Compare identified devices against the affected chipset and Android version list.
- Review OEM security bulletins for CVE-2023-33891 remediation status.
- Confirm deployed firmware or Android security patch level with the device vendor.
- Document devices with unknown chipset data as requiring vendor confirmation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-33891 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.