CVE-2024-53934

CVE-2024-53934 is a vulnerability in the com.windymob.callscreen.ringtone.callcolor.colorphone Android application, also known as Color Phone Call Screen Themes, affecting versions through 1.1.2. The issue lies in the com.frovis.androidbase.call.DialerActivity component, which permits any other application to initiate phone calls without requiring permissions or user interaction by sending a crafted intent. Classified under CWE-281, it carries a CVSS v3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high impact on confidentiality and integrity.

A local attacker with no privileges can exploit this vulnerability with low attack complexity and no user interaction required. Any malicious application installed on the device can send the crafted intent to trigger unauthorized phone calls, allowing the attacker to make arbitrary calls on the victim's behalf without their knowledge or consent.

Advisories and additional details are documented in the following GitHub repositories: https://github.com/actuator/com.windymob.callscreen.ringtone.callcolor.colorphone and https://github.com/actuator/com.windymob.callscreen.ringtone.callcolor.colorphone/blob/main/CVE-2024-53934.