{"id":"CVE-2023-48418","state":"PUBLISHED","title":"User Build misconfiguration resulting in local escalation of privilege","description":"In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a\n    possible way to access adb before SUW completion due to an insecure default\n    value. This could lead to local escalation of privilege with no additional\n    execution privileges needed. User interaction is not needed for\n    exploitation","publishedAt":"2024-01-02T22:25:31.573Z","updatedAt":"2025-06-03T14:45:10.474Z","severity":{"score":10,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"Google_Devices"},"assigner":"Google_Devices","products":["Google Pixel Watch"],"affected":[{"vendor":"Google","product":"Pixel Watch","defaultStatus":"unaffected","versions":[{"version":"11","status":"affected"}],"platforms":["Android"]}],"references":["https://source.android.com/docs/security/bulletin/pixel-watch/2023/2023-12-01","http://packetstormsecurity.com/files/176446/Android-DeviceVersionFragment.java-Privilege-Escalation.html"],"weaknesses":["CWE-269"],"ingestedAt":"2026-10-29T20:06:24.729Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/48xxx/CVE-2023-48418.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-48418","state":"PUBLISHED","datePublished":"2024-01-02T22:25:31.573Z","dateUpdated":"2025-06-03T14:45:10.474Z","assignerShortName":"Google_Devices","assignerOrgId":"83238938-5644-45f0-9007-c0392bcf6222","dateReserved":"2023-11-16T16:28:09.701Z"},"containers":{"cna":{"title":"User Build misconfiguration resulting in local escalation of privilege","descriptions":[{"lang":"en","value":"In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a\n    possible way to access adb before SUW completion due to an insecure default\n    value. This could lead to local escalation of privilege with no additional\n    execution privileges needed. User interaction is not needed for\n    exploitation"}],"affected":[{"vendor":"Google","product":"Pixel Watch","defaultStatus":"unaffected","versions":[{"version":"11","status":"affected"}],"platforms":["Android"]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel-watch/2023/2023-12-01"},{"url":"http://packetstormsecurity.com/files/176446/Android-DeviceVersionFragment.java-Privilege-Escalation.html"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Google_Devices","orgId":"83238938-5644-45f0-9007-c0392bcf6222","dateUpdated":"2024-01-10T23:06:12.635Z"},"impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://source.android.com/docs/security/bulletin/pixel-watch/2023/2023-12-01","tags":["x_transferred"]},{"url":"http://packetstormsecurity.com/files/176446/Android-DeviceVersionFragment.java-Privilege-Escalation.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T21:30:35.154Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-08T15:41:16.354905Z","id":"CVE-2023-48418","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-03T14:45:10.474Z"}}]}}}