PT-2024-23976 · Google · Android

Published 2024-07-01 · Updated 2024-12-17 · CVE-2024-31332

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to the March 2024 patch

Description The issue is related to a missing permission check that allows bypassing restrictions on adding new Wi-Fi connections. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations For Android versions prior to the March 2024 patch, apply the March 2024 security patch to resolve the issue. As a temporary workaround, consider restricting access to Wi-Fi connection settings until the patch is applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ASB-A-299931076

CVE-2024-31332

Affected Products

Android

References · 7

• https://android.googlesource.com/platform/packages/apps/Settings/+/d1f9e61e4480116838c7a642b54c217506361266 · Patch
• https://source.android.com/security/bulletin/2024-07-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-299931076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31332 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31332 · Vendor Advisory
• https://t.me/cvenotify/104591 · Telegram Post
• https://twitter.com/CVEnew/status/1810944963594821794 · Twitter Post