CVE-2023-21442

MEDIUM

Samsung Android Runestone < 2.9.09.003 (R) and < 3.2.01.007 (S) - Unauthenticated Device Location Information Disclosure

Title source: llm
STIX 2.1

Description

Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) allows local attackers to get device location information.

References (1)

Core 1

Scores

CVSS v3 4.0
EPSS 0.0005
EPSS Percentile 15.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-284
Status published
Products (2)
samsung/android 11.0 (37 CPE variants)
samsung/android 12.0 (13 CPE variants)
Published Feb 09, 2023
Tracked Since Feb 18, 2026