In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-0093 |
Exploitation
To exploit this vulnerability, an attacker would need to interact with the affected device, potentially through a malicious application or service that triggers the handleBondStateChanged function without the necessary permission checks. This could allow unauthorized access to sensitive data.
Affected Products
- Bluetooth Adapter Service: Vulnerable due to missing permission checks in the handleBondStateChanged method.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper permission checks in the AdapterService.java file to ensure that only authorized users can access sensitive data. Regular updates and patches should be applied to the affected systems.