Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without… (CVE-2026-21113)
An improper export of Android application components in Visual Voicemail versions prior to 20.1.00.05 allows local attackers to initiate calls without proper permissions. This vulnerability could enable unauthorized call initiation by local users due to insufficient component access restrictions.
AI Analysis
Technical Summary
The vulnerability involves improperly exported components in the Visual Voicemail Android application before version 20.1.00.05. These components can be accessed by local attackers who do not have the required permissions, allowing them to initiate calls without authorization. The issue stems from inadequate access control on application components, which could be exploited locally.
Potential Impact
Local attackers can initiate phone calls without proper permissions, potentially leading to unauthorized use of telephony services. The impact is limited to local privilege scope and does not involve remote exploitation or elevation of privileges beyond initiating calls.
Mitigation Recommendations
A fixed version 20.1.00.05 or later addresses this issue by properly restricting access to exported components. Users and administrators should upgrade to version 20.1.00.05 or later to remediate this vulnerability. No additional mitigation guidance is provided, and no known exploits are reported in the wild.
Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without… (CVE-2026-21113)
Description
An improper export of Android application components in Visual Voicemail versions prior to 20.1.00.05 allows local attackers to initiate calls without proper permissions. This vulnerability could enable unauthorized call initiation by local users due to insufficient component access restrictions.
CVSS v4.0
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability involves improperly exported components in the Visual Voicemail Android application before version 20.1.00.05. These components can be accessed by local attackers who do not have the required permissions, allowing them to initiate calls without authorization. The issue stems from inadequate access control on application components, which could be exploited locally.
Potential Impact
Local attackers can initiate phone calls without proper permissions, potentially leading to unauthorized use of telephony services. The impact is limited to local privilege scope and does not involve remote exploitation or elevation of privileges beyond initiating calls.
Mitigation Recommendations
A fixed version 20.1.00.05 or later addresses this issue by properly restricting access to exported components. Users and administrators should upgrade to version 20.1.00.05 or later to remediate this vulnerability. No additional mitigation guidance is provided, and no known exploits are reported in the wild.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3h7h-v27w-p5c9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-21113"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6aa15f7bacd9273b49618370
Added to database: 09/09/2026, 13:30:35 UTC
Last enriched: 09/09/2026, 13:57:12 UTC
Last updated: 09/09/2026, 22:52:09 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.