CVE-2023-21225

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

there is a possible way to bypass the protected confirmation screen due to Failure to lock display power. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-270403821References: N/A

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
n/aAndroidAndroid kernel

References

Timeline

Published
Jun 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-212267.5In SAEMM_RetrieveTaiList of SAEMM_ContextManagement.c, there is a possible out of bounds read due to an incorrect bounds check. This could lCVE-2023-212277.5In HTBLogKM of htbserver.c, there is a possible information disclosure due to log information disclosure. This could lead to local informatiCVE-2023-212289.8In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check. This could leCVE-2023-212297.8In registerServiceLocked of ManagedServices.java, there is a possible bypass of background activity launch restrictions due to an unsafe PenCVE-2023-21236.1The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leCVE-2023-212305.5In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi accesCVE-2023-212317.8In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exported or permission-pCVE-2023-212323.3In multiple locations, there is a possible way to retrieve sensor data without permissions due to a permissions bypass. This could lead to lCVE-2023-212337.5In multiple locations of avrc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information discloCVE-2023-212345.5In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PCVE-2023-212357.8In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existing PIN due to a permisCVE-2023-212366.7In aoc_service_set_read_blocked of aoc.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local es
CVE-2023-21225: High severity, CVSS 7.8 | Vulnix