Permissions, Privileges, and Access Controls in Google Android - CVE-2016-0813
Published: February 7, 2016 / Updated: August 9, 2020
Vulnerability identifier: #VU40489
CSH Severity: Medium
CVSS v4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-0813
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local non-authenticated attacker to #BASIC_IMPACT#.
packages/SystemUI/src/com/android/systemui/recents/AlternateRecentsComponent.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.x before 2016-02-01 does not properly check for device provisioning, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25476219.
Affected software
Google Android
How to mitigate CVE-2016-0813
Install update from vendor's website.