CVE-2023-21242

2023-08-1420:58:52

google_android

www.cve.org

insecureeapnetworkhandler

logic error

remote privilege escalation

cve-2023-21242

imposter server

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

52.0%

JSON

In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Android",
    "vendor": "Google",
    "versions": [
      {
        "status": "affected",
        "version": "13"
      }
    ]
  }
]