CVE-2023-38293

CVE-2023-38293 describes an AT command injection vulnerability in a pre-installed Tracfone app (com.tracfone.tfstatus) on specific Nokia C200 and C100 Android devices. This flaw allows local third-party applications to execute arbitrary AT commands within the radio user's context due to insufficient access control and input filtering. The vulnerability has a CVSS score of 7.3 (HIGH), indicating that an attacker can achieve low impact on confidentiality, integrity, and availability without requiring user interaction beyond installing a malicious app. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.