CVE-2023-21252

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
GoogleAndroid13; 12L; 12; 11

References

Timeline

Published
Oct 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-212535.5In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denialCVE-2023-212547.8In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed CVE-2023-212557.8In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of priCVE-2023-212567.8In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. ThisCVE-2023-212577.8In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing peCVE-2023-212605.5In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user pCVE-2023-212623.1In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy indicator due to a rCVE-2023-212639.8In OSMMapPMRGeneric of pmr_os.c, there is a possible out of bounds write due to an uncaught exception. This could lead to local escalation oCVE-2023-212646.7In multiple functions of mem_protect.c, there is a possible way to access hypervisor memory due to a memory access check in the wrong place.CVE-2023-212657.5In multiple locations, there are root CA certificates which need to be disabled. This could lead to remote information disclosure with no adCVE-2023-212667.8In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass. CVE-2023-212675.5In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning due to a logic error
CVE-2023-21252: Medium severity, CVSS 5.5 | Vulnix