Security readout for executives and security teams
Plain-English summary
This flaw is in UNISOC Android telephony service. A missing permission check could let a local actor read information without needing additional execution privileges. The public record does not provide CVSS, exposed data details, or a named patch level, so urgency depends on whether your fleet uses affected UNISOC chipsets and Android versions.
Executive priority
Treat this as a targeted mobile fleet exposure review, not an emergency based on available evidence. Escalate priority where affected UNISOC devices process sensitive communications or cannot be patched.
Technical view
CVE-2023-33898 covers a missing permission check in telephony service affecting specified UNISOC chipsets running Android 10 through Android 13. The stated impact is local information disclosure with no additional execution privileges. Sources do not identify CWE, CVSS vector, vulnerable API path, exploit prerequisites beyond local access, or remediation version.
Likely exposure
Exposure is likely limited to devices using listed UNISOC chipsets, including SC9863A, SC9832E, SC7731E, T310, T606, T610, T612, T616, T618, T760, T770, T820, and S8000 on Android 10 through 13.
Exploitation context
The source bundle does not report active exploitation, public exploit code, or inclusion in CISA KEV. The described attacker position is local, and the impact is information disclosure. No remote attack path is stated in the supplied sources.
Researcher notes
The public data is sparse: no CVSS, CWE, patch identifier, vulnerable component details, or exploit analysis are provided. Avoid assuming broader Android or non-UNISOC exposure without vendor confirmation.
Mitigation direction
- Check UNISOC and device OEM advisories for the relevant security update.
- Inventory Android devices for listed UNISOC chipsets and Android 10 through 13.
- Prioritize updates for devices handling sensitive voice, SMS, or subscriber data.
- Limit untrusted app installation on potentially affected devices.
- Retire or isolate devices that cannot receive vendor security fixes.
Validation and detection
- Confirm chipset model and Android version for managed device fleets.
- Review OEM security patch notes for CVE-2023-33898 coverage.
- Verify devices have received the applicable vendor or OEM security update.
- Check mobile management records for unsupported Android 10 through 13 devices.
- Document unresolved devices and compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-33898 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.