PT-2025-43457 · Unknown · Notificationstation

Published 2025-08-12 · Updated 2025-12-08 · CVE-2025-48555

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NotificationStation (affected versions not specified)

Description The software contains a possible cross-profile information disclosure due to a confused deputy condition in multiple functions of NotificationStation.java. This issue could lead to local escalation of privilege without requiring additional execution privileges or user interaction. The vulnerable functions are located at https://t.co/jFLr70O7HO. A confused deputy occurs when a program unintentionally performs an action on behalf of another program, potentially leading to unauthorized access or modification of data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-441

Related Identifiers

ASB-A-396666065

BDU:2026-00772

CVE-2025-48555

Affected Products

Notificationstation

References · 9

• https://android.googlesource.com/platform/packages/apps/Settings/+/596c7b9911f2004df83b8d2708ad4b50e8d53805 · Patch
• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00772 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48555 · Security Note
• https://osv.dev/vulnerability/ASB-A-396666065 · Vendor Advisory
• https://t.me/cveNotify/145203 · Telegram Post
• https://twitter.com/CVEnew/status/1998079602967662700 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post