CVE-2024-40652

2024-09-1100:09:17

google_android

github.com

settings app

device provisioning

missing permission check

local escalation of privilege

user interaction

AI Score

7.1

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*"
    ],
    "vendor": "google",
    "product": "android",
    "versions": [
      {
        "status": "affected",
        "version": "14"
      },
      {
        "status": "affected",
        "version": "13"
      },
      {
        "status": "affected",
        "version": "12l"
      },
      {
        "status": "affected",
        "version": "12"
      }
    ],
    "defaultStatus": "unaffected"
  }
]