CVE-2022-38694
HIGHUnisoc SC9863A/T310/T610/T618 - Local Privilege Escalation via Unchecked BootRom Write Address
Title source: llmExploitation Summary
EIP tracks 10 public exploits for CVE-2022-38694. PoCs published by TomKing062, TheGammaSqueeze, Phlegmelm.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2022-38694, targeting Unisoc (Spreadtrum) bootloader vulnerabilities. The tools manipulate firmware files to bypass bootloader locks by patching specific memory regions.
Description
In BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no additional execution privileges needed.
Exploits (10)
This repository contains functional exploit code for CVE-2022-38694, targeting Unisoc (Spreadtrum) bootloader vulnerabilities. The tools manipulate firmware files to bypass bootloader locks by patching specific memory regions.
This repository provides a functional bootloader unlock exploit for Anbernic devices using a modified version of CVE-2022-38694. It includes a script and detailed instructions for unlocking the bootloader, which is a prerequisite for flashing custom firmware.
This repository provides a functional exploit for CVE-2022-38694, targeting Unisoc UMS9230 devices to unlock the bootloader and achieve root access. It includes automated scripts and detailed documentation for the exploitation process.
This repository provides a detailed guide for unlocking the bootloader on the Retroid Pocket 3+ using CVE-2022-38694. It includes step-by-step instructions, prerequisites, and references to external tools and drivers.
This repository provides a detailed technical guide for unlocking the bootloader and installing Magisk on the ZTE Blade X1001 using CVE-2022-38694. It includes step-by-step instructions, prerequisites, and troubleshooting tips, but does not contain functional exploit code.
This repository contains a functional proof-of-concept exploit for CVE-2022-38694, which extracts sensitive user data from Unisoc ZTE devices by leveraging a diagnostics dump vulnerability. The exploit uses Unisoc BROM tools to dump data and processes it to reveal app usage, OTA history, system events, and battery statistics.
This repository provides a detailed technical guide for unlocking the bootloader and rooting the Realme C53 (RMX3760) device using CVE-2022-38694. It includes step-by-step instructions, scripts, and configuration files for building a KernelSU module and flashing a patched boot image.
This repository contains a functional exploit for CVE-2022-38694, targeting the Unisoc BootROM to unlock the bootloader on the Itel S23 (S665L) device. It includes detailed technical documentation, exploit payloads, and scripts to bypass signature verification.
This repository contains a functional exploit for CVE-2022-38694, targeting the Unisoc BootROM to unlock the bootloader on the Itel S23 (S665L) device. It includes detailed technical documentation, exploit payloads, and scripts to automate the unlock process.
This repository contains a functional exploit for CVE-2022-38694, targeting UNISOC-based devices. The code includes device-specific configurations and appears to be an unlocker tool for various UNISOC chipset models.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H