PT-2025-2849 · Google · Android

Published 2025-01-01 · Updated 2025-01-22 · CVE-2024-49734

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions No specific software name or versions are mentioned in the provided descriptions.

Description The issue concerns a possible way for a Wi-Fi access point to determine the site a device has connected to through a VPN due to side channel information disclosure in multiple functions of ConnectivityService.java. This could lead to remote information disclosure without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

ASB-A-193031925

CVE-2024-49734

Affected Products

Android

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-49734 · Security Note
• https://source.android.com/security/bulletin/2025-01-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-193031925 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-49734 · Vendor Advisory
• https://android.googlesource.com/platform/packages/modules/Connectivity/+/c16addaec604d724cf5296f89e606d558128d0cc · Note
• https://android.googlesource.com/platform/frameworks/libs/net/+/e72c61380c52a4450970556e5936c5ec03fd66fb · Note
• https://android.googlesource.com/platform/packages/modules/Connectivity/+/de7b97573ac92be4cff6ca71a1837b2fe0dcbbab · Note
• https://android.googlesource.com/platform/packages/modules/Connectivity/+/1a0dd8ccde71c2252132d60e5b897fa2f569cc76 · Note
• https://android.googlesource.com/platform/packages/modules/Connectivity/+/d5d5e5749316d31a63b9b8b132e273d29364401b · Note
• https://t.me/cvedetector/16046 · Telegram Post
• https://android.googlesource.com/platform/frameworks/libs/net/+/b20d67cbfc24a54dfe1dc9854bac61fdf52f7913 · Note
• https://android.googlesource.com/platform/packages/modules/Connectivity/+/4e80ab9ca5b9e7db8185cdde240ab0f01a2c0611 · Note
• https://android.googlesource.com/platform/packages/modules/Connectivity/+/9eb0da27c4ecff37f7b6d2328b8dee6ba766ad1a · Note
• https://twitter.com/CVEnew/status/1881933296772272488 · Twitter Post