CVE-2023-38300

A certain software build for the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys) leaks the IMEI and the ICCID to system properties that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in this instance they are leaked by a high-privilege process and can be obtained indirectly. This malicious app reads from the "persist.sys.verizon_test_plan_imei" system property to indirectly obtain the IMEI and reads the "persist.sys.verizon_test_plan_iccid" system property to obtain the ICCID.

• CWE-200

• https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf
• https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf

Published

Apr 22, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38295Certain software builds for the TCL 30Z and TCL 10 Android d…7.8
• CVE-2023-38296Various software builds for the following TCL 30Z and TCL A3…8
• CVE-2023-38297An issue was discovered in a third-party com.factory.mmigrou…8.4
• CVE-2023-38298Various software builds for the following TCL devices (30Z, …8.8
• CVE-2023-38299Various software builds for the AT&T Calypso, Nokia C100, No…5.5
• CVE-2023-3830A vulnerability was found in Bug Finder SASS BILLER 1.0. It …6.1
• CVE-2023-38301An issue was discovered in a third-party component related t…3.4
• CVE-2023-38302A certain software build for the Sharp Rouvo V device (SHARP…4.3
• CVE-2023-38303An issue was discovered in Webmin 2.021. One can exploit a s…5.4
• CVE-2023-38304An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38305An issue was discovered in Webmin 2.021. The download functi…6.1
• CVE-2023-38306An issue was discovered in Webmin 2.021. A Cross-site Script…6.1