CVE-2021-39635
Last modified
CVE-2021-39635 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634. EPSS estimates a 0.49% chance of exploitation in the next 30 days.
Description
ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | All versions |
References
- https://source.android.com/security/bulletin/2022-02-01Vendor Advisory
- https://source.android.com/security/bulletin/2022-02-01Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-39635?
How severe is CVE-2021-39635?
How do I fix CVE-2021-39635?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-3963kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)4.3
- CVE-2021-39630In executeRequest of OverlayManagerService.java, there is a …7.8
- CVE-2021-39631In clear_data_dlg_text of strings.xml, there is a possible s…5.5
- CVE-2021-39632In inotify_cb of events.cpp, there is a possible out of boun…7.8
- CVE-2021-39633In gre_handle_offloads of ip_gre.c, there is a possible page…5.5
- CVE-2021-39634In fs/eventpoll.c, there is a possible use after free. This …7.8
- CVE-2021-39636In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there i…4.4
- CVE-2021-39637In CreateDeviceInfo of trusty_remote_provisioning_context.cp…4.4
- CVE-2021-39638In periodic_io_work_func of lwis_periodic_io.c, there is a p…6.7
- CVE-2021-39639In TBD of fvp.c, there is a possible way to glitch CPU behav…6.8
- CVE-2021-3964elgg is vulnerable to Authorization Bypass Through User-Cont…5.9
- CVE-2021-39640In __dwc3_gadget_ep0_queue of ep0.c, there is a possible out…7.8
Are you affected by CVE-2021-39635?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST