Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Android Setup Wizard lets nearby attacker erase data

CVE-2016-0832 · published 10 years ago
Summary

The Setup Wizard in Android 5.1 (before LMY49H) and Android 6 (before March 2016) can be tricked by someone standing close to the device to bypass the lock that normally protects a factory reset. This lets the attacker delete all personal data without the owner's permission. Update the device to the latest software version or apply the security patch from Google as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
google android 5.0
5.0.1
5.0.2
5.1
5.1.0
5.1.1
6.0
6.0.1
cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*
Original advisory text
Setup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecifi...
Setup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25955042.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-2547PK - Security Features
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published12 Mar 2016
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-0832 · NVD
Track software like this
Free during beta