PT-2022-14555 · Google · Android

Published 2022-08-11 · Updated 2023-08-08 · CVE-2022-20329

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-13

Description The issue is related to a missing permission check in Wifi, allowing for the possibility of enabling Wifi without the necessary permissions. This could lead to a local escalation of privilege, with no additional execution privileges required. User interaction is not needed for exploitation.

Recommendations For Android version Android-13, consider disabling the Wifi feature until a patch is available to prevent potential exploitation. Restrict access to Wifi settings to minimize the risk of escalation of privilege. Avoid using Wifi without proper permission checks until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-20329

Affected Products

Android

References · 4

• https://source.android.com/security/bulletin/android-13 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20329 · Security Note
• https://t.me/cibsecurity/48089 · Telegram Post