Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-20537: Guest users can change location settings in Android Settings

CVE-2022-20537 · published 3 years ago

Summary

The Settings app on Android devices allows a Guest user to turn on location-related options without proper permission checks. This lets a Guest elevate their access on the device without needing to run additional code. Update the device to the latest software version or apply the provided patch to enforce proper permissions.

What to do

Update google platform/packages/apps/settings to version 13:2022-12-01.

Affected software

Ecosystem	Vendor	Product	Affected versions
Android	google	platform/packages/apps/settings	>= 13:0, < 13:2022-12-01 Fix: upgrade to 13:2022-12-01
–	google	android	13.0 `cpe:2.3:o:google:android:13.0:::::::*`

Original advisory text

In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive settings due to a missing permission check. This could lead to local escalation of privilege from the Guest user with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2022-12-01 Vendor Advisory
https://android.googlesource.com/platform/packages/apps/Settings/+/8b1e21f92998c... Patch
https://source.android.com/security/bulletin/pixel/2022-12-01 Patch Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.3 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published1 Dec 2022

Updated26 Oct 2026

First seen10 Sep 2026

Sources

PUB-A-235601169 · OSV

CVE-2022-20537 · NVD

Track software like this

Free during beta