Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android on Nexus 5X can let attackers gain higher privileges

CVE-2016-3905 · published 10 years ago
Summary

A flaw in the Wi‑Fi driver of Android versions released before early October 2016 on Nexus 5X phones lets a malicious app send a special Wi‑Fi command that upgrades its system rights. This could let an attacker read private data or control the device. Update the phone to the latest Android version or apply the security patch released after October 2016, and only install trusted applications.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
google android <= 7.0
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
Original advisory text
CORE/HDD/src/wlan_hdd_main.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application that sends a SENDACTIONFRAME...
CORE/HDD/src/wlan_hdd_main.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application that sends a SENDACTIONFRAME command, aka Android internal bug 28061823 and Qualcomm internal bug CR 1001449.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published10 Oct 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-3905 · NVD
Track software like this
Free during beta