CVE-2022-31760

Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services

published June 13, 2022

CVSS
—
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

⚠️ What’s worse than a locked door? A window left open! On certain carrier-customized USSD services, dialog boxes may still pop up even if your screen is locked! Think of your phone as a secure hotel room; if someone can still slip a note under the door, they can potentially see sensitive information without needing a key. These dialog boxes are like sneaky messages that can disrupt your privacy even when you're away! If exploited, an attacker could potentially view or modify sensitive data without any authentication barrier, leading to a serious compromise of data integrity and confidentiality. It’s like someone rummaging through your suitcase while you’re busy at the pool – definitely not cool!

Put simply

Think of your phone as a secure hotel room; if someone can still slip a note under the door, they can potentially see sensitive information without needing a key. These dialog boxes are like sneaky messages that can disrupt your privacy even when you're away! This vulnerability allows dialog boxes to be displayed on a locked screen during USSD operations, enabling unauthorized access to sensitive information without the device being unlocked.

What to do

If exploited, an attacker could potentially view or modify sensitive data without any authentication barrier, leading to a serious compromise of data integrity and confidentiality. It’s like someone rummaging through your suitcase while you’re busy at the pool – definitely not cool! To mitigate this issue, ensure that USSD services are configured to restrict dialog box displays when the screen is locked. Regularly review carrier settings and user permissions to minimize risks. Additionally, consider reaching out to the carrier for updates and guidance. You can tackle this! By following these steps, you'll enhance your device's security and keep those pesky vulnerabilities at bay! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00668 · 51.3th percentile
Published
2022-06-13T15:03Z
EPSS history
Timeline
  • 13 JUN 15:03Z
    Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services
    cvelistv5