CVE-2023-40040

MEDIUM 5.3CVE-2023-40040 · Published 11/09/2023 · updated 17/06/2026

In short

CVE-2023-40040 is a MEDIUM (CVSS 5.3) vulnerability affecting higrade (mycrops).
Chance of exploitation in the next 30 days (EPSS): 0.64%, higher than 51.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
higrade mycrops	`= 1.0.337`	No fix yet

Description

An issue was discovered in the MyCrops HiGrade "THC Testing & Cannabi" application 1.0.337 for Android. A remote attacker can start the camera feed via the com.cordovaplugincamerapreview.CameraActivity component in some situations. NOTE: this is only exploitable on Android versions that lack runtime permission checks, and of those only Android SDK 5.1.1 API 22 is consistent with the manifest. Thus, this applies only to Android Lollipop, affecting less than five percent of Android devices as of 2023.

References

actuator/cve · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free