CVE-2016-3887

providers/settings/SettingsProvider.java in Android 7.0 before 2016-09-01 does not properly enforce the DISALLOW_CONFIG_VPN setting, which allows attackers to…

published September 11, 2016

CVSS
—
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

providers/settings/SettingsProvider.java in Android 7.0 before 2016-09-01 does not properly enforce the DISALLOW_CONFIG_VPN setting, which allows attackers to bypass an intended always-on VPN state via a crafted application, aka internal bug 29899712.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00476 · 39.8th percentile
Published
2016-09-11T21:00Z
EPSS history
Timeline
  • 11 SEP 21:00Z
    providers/settings/SettingsProvider.java in Android 7.0 before 2016-09-01 does not properly enforce the DISALLOW_CONFIG_VPN setting, which allows attackers to…
    cvelistv5