Skip to main content

Private Messenger CVE-2020-5753

MEDIUM
Always-Incorrect Control Flow Implementation (CWE-670)
2020-05-20 vulnreport@tenable.com
Google Information Disclosure Apple Private Messenger Signal
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
May 20, 2020 - 14:15 nvd
MEDIUM 5.3

DescriptionNVD

Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined.

AnalysisAI

Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-670. Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined. Affected products include: Signal Private Messenger, Signal.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Private Messenger

View all
CVE-2019-17191 HIGH POC
7.5 Oct 05

The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, witho
CVE-2019-17192 CRITICAL
9.8 Oct 05

The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing

CVE-2018-3988 MEDIUM POC
4.7 Dec 10

Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses th
CVE-2019-9970 MEDIUM
6.5 Mar 24

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for

Same weakness CWE-670 – Always-Incorrect Control Flow Implementation

View all
CVE-2020-17466 CRITICAL POC
9.8
CVE-2025-29312 CRITICAL POC
9.1
CVE-2018-16766 HIGH POC
8.8
CVE-2026-26267 HIGH POC
7.5
CVE-2024-53270 HIGH POC
7.5
CVE-2024-53269 HIGH POC
7.5
CVE-2024-37153 HIGH POC
7.5
CVE-2023-41376 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2020-5753 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy