CVE-2023-21251

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jul 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-212525.5In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to improper input validatiCVE-2023-212535.5In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denialCVE-2023-212547.8In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed CVE-2023-212557.8In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of priCVE-2023-212567.8In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. ThisCVE-2023-212577.8In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing peCVE-2023-212605.5In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user pCVE-2023-212623.1In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy indicator due to a rCVE-2023-212639.8In OSMMapPMRGeneric of pmr_os.c, there is a possible out of bounds write due to an uncaught exception. This could lead to local escalation oCVE-2023-212646.7In multiple functions of mem_protect.c, there is a possible way to access hypervisor memory due to a memory access check in the wrong place.CVE-2023-212657.5In multiple locations, there are root CA certificates which need to be disabled. This could lead to remote information disclosure with no adCVE-2023-212667.8In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass.
CVE-2023-21251: High severity, CVSS 7.3 | Vulnix