by Kastro
Paper/Archive/CVE-2023-48418

CVE-2023-48418

Google Pixel Watch — User Build misconfiguration resulting in local escalation of privilege

EPSS 0.2%CVSS 10.0
critical.is priorityof 100
33
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 12.7.127 × 202.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a     possible way to access adb before SUW completion due to an insecure default     value. This could lead to local escalation of privilege with no additional     execution privileges needed. User interaction is not needed for     exploitation

Affected

ProductAffectedFixed inSource
Pixel Watch11–CNA

Scores by source

Google_Devices (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsource.android.com/docs/security/bulletin/pixel-watch/2023/2023-12-01refpacketstormsecurity.com/files/176446/Android-DeviceVersionFragment.java-Privilege-Escalation.html