CVE-2023-49794

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed, which causes any malicious apk named `me.weishu.kernelsu` get root permission. If a KernelSU module installed device try to install any not checked apk which package name equal to the official KernelSU Manager, it can take over root privileges on the device. As of time of publication, a patched version is not available.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jan 2, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-497955.3MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulneraCVE-2023-497965.3MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability inCVE-2023-497977.8PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privCVE-2023-497987.5OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a liCVE-2023-497997.5`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to CVE-2023-49805.4Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.CVE-2023-498007.5`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. TherCVE-2023-498017.5Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `geCVE-2023-498026.1The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to versiCVE-2023-498037.5@koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware opeCVE-2023-498047.8Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma,CVE-2023-498058.8Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it
CVE-2023-49794: High severity, CVSS 7.8 | Vulnix