PT-2023-27279 · Google · Android

Published 2023-10-01 · Updated 2023-10-30 · CVE-2023-40125

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version

Description A permission bypass issue in the ApnEditor.java file allows a Guest user to change the APN, potentially leading to local escalation of privilege without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations For Android versions prior to the fixed version, consider restricting access to the ApnEditor.java file to prevent unauthorized changes to the APN settings. As a temporary workaround, consider disabling the onCreate method in ApnEditor.java until a patch is available. Avoid using the APN settings modification feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

ASB-A-279902472

CVE-2023-40125

Affected Products

Android

References · 8

• https://osv.dev/vulnerability/ASB-A-279902472 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/Settings/+/63d464c3fa5c7b9900448fef3844790756e557eb · Patch
• https://osv.dev/vulnerability/CVE-2023-40125 · Vendor Advisory
• https://source.android.com/security/bulletin/2023-10-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40125 · Security Note
• https://t.me/cibsecurity/73083 · Telegram Post
• https://twitter.com/CVEnew/status/1718004218399801612 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1718034266322239998 · Twitter Post