CVE-2022-20041

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06108596; Issue ID: ALPS06108596.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
MediaTek, Inc.MT8167, MT8175, MT8183, MT8362A, MT8365, MT8385Android 8.1, 9.0, 10.0, 11.0, 12.0

References

Timeline

Published
Feb 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-200425.5In Bluetooth, there is a possible information disclosure due to incorrect error handling. This could lead to local information disclosure wiCVE-2022-200437.8In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilegCVE-2022-200447.8In Bluetooth, there is a possible service crash due to a use after free. This could lead to local escalation of privilege with no additionalCVE-2022-200457.8In Bluetooth, there is a possible service crash due to a use after free. This could lead to local escalation of privilege with no additionalCVE-2022-200465.5In Bluetooth, there is a possible memory corruption due to a logic error. This could lead to local denial of service with no additional execCVE-2022-200477.8In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wiCVE-2022-200487.8In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wiCVE-2022-200496.7In vpu, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege withCVE-2022-20057.5AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow anCVE-2022-200506.7In connsyslogger, there is a possible symbolic link following due to improper link resolution. This could lead to local escalation of privilCVE-2022-200515.5In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. This could lead to local denial oCVE-2022-200526.5In mdp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System executio
CVE-2022-20041: High severity, CVSS 7.8 | Vulnix