Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Android TV can be paired silently, enabling remote code execution

CVE-2021-0889 · published 5 years ago
Summary

Android TV devices allow a pairing process that does not limit how often it can be tried. An attacker can exploit this to connect without the user’s knowledge and run code on the TV. Apply the latest software updates from Google to close the gap.

What to do
  • Update google :unknown: to version 8.1:2021-11-05.
  • Update google :unknown: to version 9:2021-11-05.
  • Update google :unknown: to version 10:2021-11-05.
  • Update google :unknown: to version 11:2021-11-05.
  • Update google :unknown: to version 12:2021-11-05.
Affected software
Ecosystem VendorProductAffected versions
Android google :unknown: >= 8.1:0, < 8.1:2021-11-05
>= 9:0, < 9:2021-11-05
>= 10:0, < 10:2021-11-05
>= 11:0, < 11:2021-11-05
>= 12:0, < 12:2021-11-05
Fix: upgrade to 8.1:2021-11-05
– google android 8.1
9.0
10.0
11.0
12.0
cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*
Original advisory text
In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. This could lead to remote code execution with no additional execution privileges needed. User in...
In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Timeline
Published1 Nov 2021
Updated3 Nov 2026
First seen10 Sep 2026
Sources
ASB-A-180745296 · OSV
CVE-2021-0889 · NVD
Track software like this
Free during beta