CVE-2022-20145: Critical severity android vulnerability

Published Jun 6, 2022

Updated

In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack. This could lead to remote escalation of privilege if a malicious Wi-Fi AP is used, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-201660636

Affected Software

2 affected components

Google Android=11.0

Google Android

Event History

Jun 6, 2022

CVE Published

via Android·12:00 AM

Jun 15, 2022

CVE Published

via MITRE·01:02 PM

Data Sourced

via MITRE·01:02 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2022-20145?

CVE-2022-20145 is classified as a high severity vulnerability due to the potential for remote escalation of privilege.

How do I fix CVE-2022-20145?

To fix CVE-2022-20145, users should update their Android device to a patched version beyond Android 11.0.

What type of attack does CVE-2022-20145 expose users to?

CVE-2022-20145 exposes users to a protocol downgrade attack that can retrieve VPN credentials.

Is user interaction required for exploitation of CVE-2022-20145?

No, user interaction is not needed for the exploitation of CVE-2022-20145.

Which products are affected by CVE-2022-20145?

CVE-2022-20145 affects Google Android version 11.0.