Vulnerability · Published Jan 2, 2024 · Assigned by Google_Devices
CVE-2023-48418User Build misconfiguration resulting in local escalation of privilege
Critical 10.0
In plain English
A critical-severity privilege mismanagement in Pixel Watch from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Pixel Watch | 11 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H