ASB-A-299633613

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-299633613.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-299633613

Aliases

A-299633613
CVE-2025-48599

Published

2025-12-01T00:00:00Z

Modified

2025-12-11T17:02:46.223742Z

Summary

[none]

Details

In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2025-12-01

Affected packages

Android / platform/packages/apps/Settings

Package

Name: platform/packages/apps/Settings

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16-qpr2-next:0

Fixed

16-qpr2-next:2025-12-01

Affected versions

Other

16-qpr2-next

Ecosystem specific

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd",
            "id": "ASB-A-299633613-346f9cac",
            "deprecated": false,
            "target": {
                "file": "src/com/android/settings/wifi/WifiScanModeActivity.java",
                "function": "createDialog"
            },
            "signature_type": "Function",
            "digest": {
                "function_hash": "64696810561082008628559458199911444117",
                "length": 373.0
            }
        },
        {
            "id": "ASB-A-299633613-876e5d21",
            "deprecated": false,
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "89376418065807262447808223030731093779",
                    "245223663508855083818987235872926520314",
                    "185361308249400309827113014171377237734",
                    "301007619386576210011837872747415215439",
                    "107953047751076758067017671687589631031",
                    "168600131244329287626518020324308538823",
                    "334366402942684249038487745103254858911",
                    "49389187724200439243669305482858509403",
                    "270022714606229581118045442983011668791",
                    "99495797579039669202823682838789500193",
                    "122622744142526859596486861860012572182",
                    "157291175614990384870858593243873373942",
                    "59620969055057726242319306689531082737",
                    "68275933987951957406150266224150448454",
                    "239318532479909445987400015032593607107",
                    "180166770642520905823190102669083513994",
                    "11846326348411623406849527802725139991",
                    "80068110662887232852161325181558082896",
                    "331787673812818604577590912747645605950",
                    "72848376057255200823940538838258269513",
                    "192506471539439845641724213960584446713",
                    "208837401023542939562145259552944550663",
                    "61603809998057729785544299683168331761",
                    "152249443256410510551281691779562835317",
                    "5094385055108455765049560138984714338",
                    "160987810320833315605559502563506053996",
                    "181548646181419310594768686991153204687",
                    "88728296968983629139458528544804312118",
                    "228809379267721086738612532260398970155",
                    "52186965110787366096824119911691836666",
                    "41731445206662845544983019564872676725",
                    "100405455990521186629608743181603008747",
                    "37549339332988269387709044132600133252",
                    "235471368486425943364986896716100196448",
                    "70521497133401826068380567488234520981",
                    "33543875593775229356449625031429984847",
                    "89017946450876242333870943441406477628",
                    "292270081348965487072592109231616770447",
                    "132733104563646712537930550813087637504",
                    "213731206802248309526621220358360862575",
                    "334684211700406494928651775955925528981",
                    "313391744054598149159787591906086719643",
                    "202668394745659911507472766453371077013",
                    "292735851573084854695656415541219018238",
                    "224626410932392954299892133560717946311",
                    "303695845142257422408569259287348757135",
                    "85909635464382419600120913335190012694",
                    "291023888780200237785683744573319119687",
                    "216556559037406704587250274627605854495",
                    "118780248108373891649575380364586316168",
                    "258611492791612508990165455962210154149",
                    "340003587602330950927957411020607820049",
                    "39984497540760544846944916603573097578",
                    "13292003060342391469665896966217466316"
                ]
            },
            "match_only_versions": [
                "16-qpr2-next"
            ],
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd",
            "target": {
                "file": "src/com/android/settings/wifi/WifiScanModeActivity.java"
            }
        },
        {
            "exact_target_file_match_only": true,
            "id": "ASB-A-299633613-ff554823",
            "signature_type": "Function",
            "digest": {
                "function_hash": "188295159672899519304942434192811403587",
                "length": 187.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd",
            "target": {
                "file": "src/com/android/settings/wifi/WifiScanModeActivity.java",
                "function": "isGuestUser"
            }
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd"
    ],
    "types": [
        "EoP"
    ]
}

Android / platform/packages/apps/Settings

Package

Name: platform/packages/apps/Settings

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13:0

Fixed

13:2025-12-01

Affected versions

Other

Ecosystem specific

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c8b1a4720a1f38c92ae49b0d156e8fe8ceeac446",
            "id": "ASB-A-299633613-da2e5682",
            "deprecated": false,
            "target": {
                "file": "src/com/android/settings/wifi/WifiScanModeActivity.java"
            },
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "49495261199254921952323577008448206907",
                    "78016449987601987235791248165404880181",
                    "304748368377060064966815848641393205699",
                    "268257495089161562332630312097263370617",
                    "20084663032027974877644383978751334526",
                    "24244162159008669250711786970111926944",
                    "128902167704304713786662264768397034737",
                    "203742218110522710565404928247286224076",
                    "89376418065807262447808223030731093779",
                    "192783271548435201179492028009613489935",
                    "205590085519228782754809691205375309939",
                    "64950636608198087317492626991849203076",
                    "309311672629146260666418030897801897204",
                    "275061548306180913522711608089488951383",
                    "88385865971706246233390319659732845112",
                    "67591367833042427268291829365403322585",
                    "130811660742352081567886956322758940129",
                    "337804296410846834241371898750323520206"
                ]
            }
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c8b1a4720a1f38c92ae49b0d156e8fe8ceeac446",
            "id": "ASB-A-299633613-fa166c44",
            "deprecated": false,
            "target": {
                "file": "src/com/android/settings/wifi/WifiScanModeActivity.java",
                "function": "createDialog"
            },
            "signature_type": "Function",
            "digest": {
                "function_hash": "34728420961191027874925828834925442004",
                "length": 150.0
            }
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/c8b1a4720a1f38c92ae49b0d156e8fe8ceeac446"
    ],
    "types": [
        "EoP"
    ]
}

Android / platform/packages/apps/Settings

Package

Name: platform/packages/apps/Settings

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14:0

Fixed

14:2025-12-01

Affected versions

Other

Ecosystem specific

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "exact_target_file_match_only": true,
            "id": "ASB-A-299633613-40af94bb",
            "signature_type": "Function",
            "digest": {
                "function_hash": "188295159672899519304942434192811403587",
                "length": 187.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/72eed92411b9968aae7dbcf40b32d5018eddae8b",
            "target": {
                "file": "src/com/android/settings/wifi/WifiScanModeActivity.java",
                "function": "isGuestUser"
            }
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/72eed92411b9968aae7dbcf40b32d5018eddae8b",
            "id": "ASB-A-299633613-75a318df",
            "deprecated": false,
            "target": {
                "file": "src/com/android/settings/wifi/WifiScanModeActivity.java"
            },
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "72848376057255200823940538838258269513",
                    "192506471539439845641724213960584446713",
                    "208837401023542939562145259552944550663",
                    "216556559037406704587250274627605854495",
                    "118780248108373891649575380364586316168",
                    "258611492791612508990165455962210154149",
                    "340003587602330950927957411020607820049",
                    "39984497540760544846944916603573097578",
                    "13292003060342391469665896966217466316"
                ]
            }
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/72eed92411b9968aae7dbcf40b32d5018eddae8b",
            "id": "ASB-A-299633613-fc38d5f3",
            "deprecated": false,
            "target": {
                "file": "src/com/android/settings/wifi/WifiScanModeActivity.java",
                "function": "createDialog"
            },
            "signature_type": "Function",
            "digest": {
                "function_hash": "64696810561082008628559458199911444117",
                "length": 373.0
            }
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/72eed92411b9968aae7dbcf40b32d5018eddae8b"
    ],
    "types": [
        "EoP"
    ]
}