CVE-2021-1037

The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to listen for it

published January 14, 2022

CVSS
—
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to listen for it. This lets apps keep track of what devices are paired without requesting BLUETOOTH permissions.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-162951906

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00316 · 23.2th percentile
Published
2022-01-14T19:11Z
EPSS history
Timeline
  • 14 JAN 19:11Z
    The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to listen for it
    cvelistv5