CVE-2024-49736: Settings App Vulnerability Leading to Unauthorized Factory Reset
Summary
CVE-2024-49736: In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the code. Affects platform/packages/apps/Settings across 4 version ranges.
>= 12:0, < 12:2025-01-01
>= 12L:0, < 12L:2025-01-01
>= 13:0, < 13:2025-01-01
>= 14:0, < 14:2025-01-01
Fixed in 12:2025-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Settings app in Android is a core component that allows users to configure system settings, manage applications, and control device functionalities. It plays a crucial role in user experience and device management. However, a logic error in the MainClear.java file has introduced a vulnerability that could allow unauthorized factory resets, compromising user control over their devices.
Vulnerability Detail
In the onClick method of MainClear.java, a logic error exists that could potentially trigger a factory reset without explicit user consent. This vulnerability can lead to a local denial of service, as it allows the device to reset itself without requiring any additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly concerning for device security.
How To Fix
Minimum fixed version
12:2025-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Settings app or restrict its permissions until the patch is applied. This can help mitigate the risk of unauthorized factory resets while waiting for the official fix.
Conclusion
The vulnerability identified as CVE-2024-49736 in the Android Settings app poses a significant risk by allowing unauthorized factory resets. Users are advised to update their app to the latest version to protect against this issue. Temporary workarounds are available, but the best course of action is to apply the patch as soon as it is available.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
CVE-2024-49736 is a vulnerability in the Android Settings app that allows unauthorized factory resets due to a logic error in the code.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If your device is affected, update the Settings app to the patched version available as of January 1, 2025, to mitigate the vulnerability.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
The main consequence is a local denial of service, where the device can reset itself without user consent, leading to data loss and disruption of service.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
