VDB
CVE-2023-48418
CVE-2023-48418
PUBLISHED
CVSS 10 CRITICAL
In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation
EPSS 0.22% · 12.9th percentile
Risk Scores
CVSS 3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
0.22%
12.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pixel_watch_firmware | ||
| Pixel Watch | 11, 11 |
Timeline
- Jan 2, 2024 CVE Published
- Jan 3, 2024 PoC Published
- Jan 3, 2024 PoC Published
- Jan 10, 2024 EPSS Score
- Jan 11, 2024 PoC Published
- Jan 17, 2024 PoC Published
- Jan 23, 2024 PoC Published
- Feb 7, 2024 EPSS Score
- Mar 7, 2024 EPSS Score
- Apr 4, 2024 EPSS Score
- May 3, 2024 EPSS Score
- May 31, 2024 EPSS Score