CVE-2022-23835 | BDVDB-2026-170771 Detail

Description#

The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READ_SMS permission, and reads an IMAP credentialing message that is (by design) not displayed to the victim within the AOSP SMS/MMS messaging application. (Often, the IMAP credentials are usable to listen to voice mail messages sent before the vulnerability was exploited, in addition to new ones.) NOTE: some vendors characterize this as not a "concrete and exploitable risk.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://gitlab.com/kop316/vvm-disclosure
https://www.kb.cert.org/vuls/id/383864

Exploit#

No public exploit known

History#

Version 12022-02-25Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.