Security readout for executives and security teams
Plain-English summary
This CVE describes a local denial-of-service issue in the FM service on listed UNISOC chipsets used in Android devices. The public record says System execution privileges are needed, which makes broad opportunistic abuse less likely. Business impact is mainly device disruption where affected chipsets and Android versions are present.
Executive priority
Treat this as a targeted mobile fleet hygiene issue, not an emergency internet-facing vulnerability. Prioritize inventory and OEM update checks for managed Android devices that use the named UNISOC chipsets.
Technical view
CVE-2023-33903 is described as a missing parameter check in the FM service. The stated impact is local denial of service, with System execution privileges needed. The sources list multiple UNISOC chipsets on Android 10, 11, 12, and 13. No CVSS, CWE, exploit details, or specific fixed versions are provided.
Likely exposure
Exposure is limited to Android devices using the listed UNISOC chipsets and Android versions. This is not a typical server, cloud, or browser exposure. The record does not identify specific handset models, OEM firmware builds, or fleet prevalence.
Exploitation context
The source bundle does not show CISA KEV listing or public active exploitation. The described prerequisite of System execution privileges significantly raises the exploitation bar. Public evidence is too limited to assess real-world exploit maturity.
Researcher notes
The available public data is sparse: no CVSS vector, CWE, patch version, or proof-of-concept status is supplied. Avoid assuming handset models or exploitability beyond the stated local denial-of-service impact and System privilege requirement.
Mitigation direction
- Inventory Android devices using the listed UNISOC chipsets and Android 10-13.
- Check the UNISOC announcement and device OEM bulletins for firmware guidance.
- Apply OEM firmware or security updates when available.
- Restrict privileged local code execution through device management and app installation policy.
- Retire or isolate affected devices that cannot receive vendor security updates.
Validation and detection
- Confirm device chipset, Android version, and vendor security patch level.
- Compare fleet devices against the affected UNISOC chipset list.
- Review OEM advisories for model-specific fixed firmware information.
- Track whether affected devices expose or use the FM service.
- Document devices with no available vendor remediation path.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-33903 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.