TI-2023-14542 Aliases CVE-2023-30728 GHSA-fr6r-54r2-j3w3

Intent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00…

LOW 24Published 2023-09-06 · Updated 2024-09-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Intent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00 allows local attacker to access arbitrary file. This vulnerability requires user interaction.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.002 9th percentileScored 2026-11-07

Fix Fixed PackageInstallerCHN (Samsung Mobile): 13.1.03.00

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Samsung	PackageInstallerCHN	—	13.1.03.00	Patch available	CNA

PackageInstallerCHN VendorSamsung Affected — Fixed in 13.1.03.00 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:samsung:packageinstallerchn::::::::	before 13.1.03.00	Vulnerable	Samsung

cpe:2.3:a:samsung:packageinstallerchn:*:*:*:*:*:*:*:* Versions before 13.1.03.00 Vulnerable ·Samsung

Remediation

Fix · CNA PackageInstallerCHN (Samsung Mobile) Fixed in 13.1.03.00

Timeline

2026-10-02 Threatist record created from CVE-2023-30728
2026-10-03 Alias added: GHSA-fr6r-54r2-j3w3

References

Advisory 1

https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences