CVE-2022-20125

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-194402515

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-201267.3In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing CVE-2022-201279.8In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of bounds write due to a double free. This could lead to remote code execution wiCVE-2022-201295.5In registerPhoneAccount of PhoneAccountRegistrar.java, there is a possible way to prevent the user from selecting a phone account due to impCVE-2022-20137.5In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new CVE-2022-201309.8In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to CVE-2022-201317.5In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remotCVE-2022-201324.6In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validatiCVE-2022-201337.8In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This couCVE-2022-201347.8In readArguments of CallSubjectDialog.java, there is a possible way to trick the user to call the wrong phone number due to improper input vCVE-2022-201357.8In writeToParcel of GateKeeperResponse.java, there is a possible parcel format mismatch. This could lead to local escalation of privilege wiCVE-2022-201377.3In onCreateContextMenu of NetworkProviderSettings.java, there is a possible way for non-owner users to change WiFi settings due to a missingCVE-2022-201387.8In ACTION_MANAGED_PROFILE_PROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app to send MANAGED_PROFI
CVE-2022-20125: Medium severity, CVSS 6.8 | Vulnix