CVE-2022-20137: Multiple users can share WI-FI and change WI-FI network in platform/packages/apps/Settings
Summary
CVE-2022-20137: In onCreateContextMenu of NetworkProviderSettings.java, there is a possible way for non-owner users to change WiFi settings due to a missing permission check. Affects platform/packages/apps/Settings across 3 version ranges.
>= 12:0, < 12:2022-06-01
>= 12L:0, < 12L:2022-06-01
>= 12L-next:0, < 12L-next:2022-06-01
Fixed in 12L-next:2022-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/packages/apps/Settings package is a part of the Android ecosystem and is responsible for managing various settings on an Android device. It provides a user interface for configuring system settings, including network settings such as WI-FI. This package is vulnerable to a privilege escalation vulnerability that allows non-owner users to change WI-FI settings without proper permission checks.
Vulnerability Detail
The vulnerability exists in the onCreateContextMenu function of the NetworkProviderSettings.java file. Due to a missing permission check, non-owner users can exploit this vulnerability to change WI-FI settings, leading to a local escalation of privilege. The exploitation requires user interaction, and the attacker needs User execution privileges. This vulnerability can have severe consequences as it allows unauthorized users to modify WI-FI network settings, potentially compromising network security and privacy.
How To Fix
Minimum fixed version
12L-next:2022-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can protect themselves by ensuring that their Android devices are updated with the latest security patches and system updates. Regularly checking for and installing updates from the device manufacturer or official sources can help mitigate the risk of exploitation.
Conclusion
The platform/packages/apps/Settings package in Android is vulnerable to a privilege escalation vulnerability that allows non-owner users to change WI-FI settings without proper permission checks. This can lead to a local escalation of privilege and compromise network security and privacy. Developers should update the package to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
This vulnerability allows non-owner users to change WI-FI settings on an Android device, potentially compromising network security and privacy.
Any Android device running an affected version of the platform/packages/apps/Settings package is vulnerable to this issue.
Yes, user interaction is needed for the exploitation of this vulnerability.
User execution privileges are needed for the successful exploitation of this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
