What is the CVSS score of CVE-2023-33898?

CVE-2023-33898 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

S8000 CVE-2023-33898

MEDIUM

Missing Authorization (CWE-862)

2023-07-12 security@unisoc.com

Information Disclosure Authentication Bypass S8000 Sc7731E Sc9832E Sc9863A T310 T606 T610 T612 T616 T618 T760 T770 T820

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jul 12, 2023 - 09:15 nvd

MEDIUM 5.5

DescriptionNVD

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

AnalysisAI

In telephony service, there is a missing permission check. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. Affected products include: Unisoc S8000, Unisoc Sc7731E, Unisoc Sc9832E, Unisoc Sc9863A, Unisoc T310.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.