CVE-2023-21242 : In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible

In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Published 2023-08-14 21:15:12

Updated 2023-08-24 15:38:05

Source Android (associated with Google Inc. or Open Handset Alliance)

View at NVD, CVE.org

Products affected by CVE-2023-21242

Google » Android » Version: 13.0
cpe:2.3:o:google:android:13.0:-:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-21242

EPSS FAQ

0.90%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 74 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-21242

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2023-21242

https://source.android.com/security/bulletin/2023-08-01

Android Security Bulletin—August 2023 | Android Open Source Project
Patch;Vendor Advisory

CVEs referencing this url
https://android.googlesource.com/platform/packages/modules/Wifi/+/72e903f258b5040b8f492cf18edd124b5a1ac770

72e903f258b5040b8f492cf18edd124b5a1ac770 - platform/packages/modules/Wifi - Git at Google
Patch

Jump to

Vulnerability Details : CVE-2023-21242

Products affected by CVE-2023-21242

Exploit prediction scoring system (EPSS) score for CVE-2023-21242

CVSS scores for CVE-2023-21242

References for CVE-2023-21242