CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application (without any permissions) can craft an intent targeting com.cutestudio.dialer.activities.DialerActivity via the android.intent.action.CALL action in conjunction with a tel: URI, thereby placing a phone call.

• CWE-269

• https://github.com/actuator/com.cutestudio.colordialer/blob/main/CWE-284.mdExploit, Third Party Advisory
• https://github.com/actuator/com.cutestudio.colordialer/blob/main/dial.gifExploit
• https://github.com/actuator/com.cutestudio.colordialer/blob/main/dialerPOC.apkExploit
• https://github.com/actuator/cve/blob/main/CVE-2023-42468Third Party Advisory
• https://github.com/actuator/com.cutestudio.colordialer/blob/main/CWE-284.mdExploit, Third Party Advisory
• https://github.com/actuator/com.cutestudio.colordialer/blob/main/dial.gifExploit
• https://github.com/actuator/com.cutestudio.colordialer/blob/main/dialerPOC.apkExploit
• https://github.com/actuator/cve/blob/main/CVE-2023-42468Third Party Advisory

Published

Sep 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42461GLPI stands for Gestionnaire Libre de Parc Informatique is a…9.8
• CVE-2023-42462GLPI stands for Gestionnaire Libre de Parc Informatique is a…9.1
• CVE-2023-42463Wazuh is a free and open source platform used for threat pre…7.8
• CVE-2023-42464A Type Confusion vulnerability was found in the Spotlight RP…9.8
• CVE-2023-42465Sudo before 1.9.15 might allow row hammer attacks (for authe…7
• CVE-2023-42467QEMU through 8.0.0 could trigger a division by zero in scsi_…5.5
• CVE-2023-42469The com.full.dialer.top.secure.encrypted application through…3.3
• CVE-2023-4247The GiveWP plugin for WordPress is vulnerable to Cross-Site …5.4
• CVE-2023-42470The Imou Life com.mm.android.smartlifeiot application throug…9.8
• CVE-2023-42471The wave.ai.browser application through 1.0.35 for Android a…9.8
• CVE-2023-42472Due to insufficient file type validation, SAP BusinessObject…7.3
• CVE-2023-42473S/4HANA Manage (Withholding Tax Items) - version 106, does n…5.4