Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Google Settings app lets local user change admin call settings

CVE-2023-21172 · published 3 years ago
Summary

The Settings application on Android devices can be tricked into altering the admin user's Wi‑Fi calling preferences without proper permission checks. This means a person with access to the device can raise their own privileges by changing how calls are handled, without needing to run any code. Updating the device to the latest security patch or applying the vendor’s fix will stop this behavior.

What to do
  • Update google platform/packages/apps/settings to version 13-next:2023-06-01.
  • Update google platform/packages/apps/settings to version 13:2023-06-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/packages/apps/settings >= 13-next:0, < 13-next:2023-06-01
>= 13:0, < 13:2023-06-01
Fix: upgrade to 13-next:2023-06-01
– google android 13.0
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
Original advisory text
In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissions bypass. This could lead to local escalation of privi...
In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published1 Jun 2023
Updated30 Sep 2026
First seen15 Apr 2026
Sources
PUB-A-262243015 · OSV
CVE-2023-21172 · NVD
Track software like this
Free during beta