CVE-2023-48418

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Jan 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-484199.8An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege CVE-2023-48425.4The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode CVE-2023-484206.4there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privilege CVE-2023-484217.8In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/platform/pixel/pixel_gpu_slc.c, there is a possibl CVE-2023-484225.5In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local informatio CVE-2023-484239.8In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote cod CVE-2023-484249.8U-Boot shell vulnerability resulting in Privilege escalation in a production device CVE-2023-484259.8U-Boot vulnerability resulting in persistent Code Execution CVE-2023-4842610.0u-boot bug that allows for u-boot shell and interrupt over UART CVE-2023-484279.8A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certific CVE-2023-484287.2A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism of affected products CVE-2023-484292.7A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the lengt