ASB-A-219546241 — Vulnetix

ASB-A-219546241 PUBLISHED CVSS 6.900000095367432 MEDIUM

In onDefaultNetworkChanged of Vpn.java, there is a possible way to disable VPN due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Risk Scores

CVSS 4.0

6.900000095367432

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products

Vendor	Product	Versions
platform	frameworks/base	12, 12L:0, 12L

Timeline

Aug 1, 2022 CVE Published
May 15, 2026 CVE Updated

References

https://source.android.com/security/bulletin/2022-08-01 advisory
https://android.googlesource.com/platform/frameworks/base/+/90fece0bec5e4d5c04c422d09c2122ac0b894da5 patch
https://android.googlesource.com/platform/frameworks/base/+/7e943a04c5f5c6a99292c0b0a8103307548cfd26 patch

Open in Interactive Console →