CVEvulnerability
CVE-2024-34734
7.8 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2024-08-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.7 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-1188
Description
In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected configurations
• google android 13.0
• google android 14.0
Related
Weakness · CWE (1)
- CWE-1188 Initialization of a Resource with an Insecure Default weakness
References
- https://android.googlesource.com/platform/frameworks/base/+/207584fb6f820eba14251251d7e9331bfd57adb8 Mailing List, Patch
- https://source.android.com/security/bulletin/2024-08-01 Patch, Vendor Advisory