CVE-2022-30725 : Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionErr

Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.

Published 2022-06-07 18:15:13

Updated 2022-06-11 02:03:58

Source Samsung Mobile

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-30725

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 13 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-30725

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:A/AC:L/Au:N/C:P/I:N/A:N	6.5	2.9	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	2.5	1.4	Samsung Mobile
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2022-30725

CWE-280 Improper Handling of Insufficient Permissions or Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Assigned by: mobile.security@samsung.com (Secondary)

CWE-755 Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2022-30725

Google » Android » Version: 10.0
cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
Matching versions
Google » Android » Version: 11.0
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
Matching versions
Google » Android » Version: 12.0
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-30725

Exploit prediction scoring system (EPSS) score for CVE-2022-30725

CVSS scores for CVE-2022-30725

CWE ids for CVE-2022-30725

References for CVE-2022-30725

Products affected by CVE-2022-30725