{"id":"CVE-2025-1704","state":"PUBLISHED","title":"ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices ","description":"ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices \nand intercept device management requests via loading components from the unencrypted stateful partition.","publishedAt":"2025-04-16T23:06:28.279Z","updatedAt":"2025-05-08T19:15:06.471Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"ChromeOS","products":["Google ChromeOS"],"affected":[{"vendor":"Google","product":"ChromeOS","versions":[{"version":"15823.23.0","status":"affected","lessThan":"15823.23.0","versionType":"custom"}]}],"references":["https://issuetracker.google.com/issues/359915523","https://issues.chromium.org/issues/b/359915523"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1704.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1704","state":"PUBLISHED","datePublished":"2025-04-16T23:06:28.279Z","dateUpdated":"2025-05-08T19:15:06.471Z","assignerShortName":"ChromeOS","assignerOrgId":"7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f","dateReserved":"2025-02-25T23:19:38.958Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices \nand intercept device management requests via loading components from the unencrypted stateful partition."}],"affected":[{"vendor":"Google","product":"ChromeOS","versions":[{"version":"15823.23.0","status":"affected","lessThan":"15823.23.0","versionType":"custom"}]}],"references":[{"url":"https://issuetracker.google.com/issues/359915523"},{"url":"https://issues.chromium.org/issues/b/359915523"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Use-After-Free (UAF)"}]}],"providerMetadata":{"shortName":"ChromeOS","orgId":"7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f","dateUpdated":"2025-05-08T19:15:06.471Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-17T15:48:23.843965Z","id":"CVE-2025-1704","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","type":"CWE","lang":"en","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-07T19:45:03.703Z"}}]}}}