CVE-2023-21134

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been factory reset with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Google	Android	13; 12L; 12

References

Timeline

Published: Aug 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-211357.8In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to improper input validati CVE-2023-211365.5In multiple functions of JobStore.java, there is a possible way to cause a crash on startup due to improper input validation. This could lea CVE-2023-211375.5In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of service with no additio CVE-2023-211387.8In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation. This could le CVE-2023-211397.8In bindPlayer of MediaControlPanel.java, there is a possible launch arbitrary activity in SysUI due to Unsafe Intent. This could lead to loc CVE-2023-21147.2The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concate CVE-2023-211406.8In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check CVE-2023-211415.5In several functions of several files, there is a possible way to access developer mode traces due to a permissions bypass. This could lead CVE-2023-211425.5In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass. This could lead to local informatio CVE-2023-211435.5In multiple functions of multiple files, there is a possible way to make the device unusable due to improper input validation. This could le CVE-2023-211447.5In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This CVE-2023-211457.8In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in t