CVE-2020-0201: Critical severity android vulnerability
In showSecurityFields of WifiConfigController.java there is a possible credential leak due to a confused deputy. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143601727
Affected Software
Remediation
Event History
Frequently Asked Questions
Which devices are identified as affected?
The affected product and version listed are Google Android 10. The issue is tracked as Android ID A-143601727.
What does an attacker need to exploit this issue?
The CVSS vector indicates network-based exploitation with low attack complexity. No attacker privileges or user interaction are required.
How serious is the potential impact?
Successful exploitation could cause a credential leak and remote escalation of privilege. The listed impact includes high confidentiality, integrity, and availability impact.
What should organizations do to remediate it?
A patch is available. Apply the applicable Android security update from the device vendor or update channel.