• Security CVES
• High CVE-2021-39636,CVE-2021-39635,CVE-2021-39616

• CVE ID CVE-2021-39636
• Title Elevation of Privilege in net service
• Description

  Net service does not verify the permission, so the caller may cause Elevation of Privilege issue.

• Technology Area System
• Vulnerability Type CWE-862 Missing Authorization
• Access Vector Local
• CVSS Rating High
• CVSS Score 7.3
• CVSS String CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:F/RC:C
• Affected Chipsets*

  SC9863A/SC9832E/SC7731E/UMS512/UMS312/UMS9230/UMS9620

• CVE ID CVE-2021-39635
• Title Elevation of Privilege in net service
• Description

  Do not check the Authorization may cause Elevation of Privilege issue of VoLTE.

• Technology Area System
• Vulnerability Type CWE-862 Missing Authorization
• Access Vector Local
• CVSS Rating High
• CVSS Score 7.3
• CVSS String CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:F/RC:C
• Affected Chipsets*

  SC9863A/SC9832E/SC7731E/UMS512/UMS312/UMS9230/UMS9620

• CVE ID CVE-2021-39616
• Title IPSec Server has EoP Vulnerability
• Description

  Do not check the privileges of  IPSEC Server, causing local privilege escalation

• Technology Area System
• Vulnerability Type CWE-78 OS Command Injection
• Access Vector Local
• CVSS Rating High
• CVSS Score 7.3
• CVSS String CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:F/RC:C
• Affected Chipsets*

  SC9863A/SC9832E/SC7731E/UMS512/UMS312/UMS9230/UMS9620

*The list of affected chipsets may not be complete. For latest information, device OEMs can contact directly at https://unisupport.unisoc.com

• Abbreviation Interpretation
• RCE Remote Code Execution
• EoP Elevation of Privilege
• ID Information Disclosure
• DoS Denial of Service
• N/A Classification not available

• Version Date Description
• 1.0 2022-02-07