A logic error in the code may allow avdtp and avctp channels to be unencrypted in multiple locations. This vulnerability could lead to local escalation of privilege, requiring user execution privileges. Notably, user interaction is not necessary for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-0079 |
Exploitation
To exploit this vulnerability, an attacker with local access could leverage the unencrypted avdtp and avctp channels to escalate privileges without requiring any user interaction. This could potentially allow the attacker to execute unauthorized actions on the device.
Affected Products
- Bluetooth Module: The Bluetooth module may be affected due to the unencrypted channels, leading to potential privilege escalation.
- Android Devices: Any Android device utilizing the affected Bluetooth channels could be vulnerable to this issue.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Android. Users should ensure their devices are running the most recent software version to protect against potential exploitation.