Global infos:

In updateCapabilities of ConnectivityService.java, there is a possible incorrect network state determination due to a logic error in the code. This could lead to biasing of networking tasks to occur on non-VPN networks, which could lead to remote information disclosure, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-179053823

CVE Status: Modified

References:

[email protected]

af854a3a-2127-422b-91ae-364da2661108

Metrics:

Attribute	Value
Attack Complexity	LOW
Attack Vector	NETWORK
Availability Impact	NONE
Base Score	7.5
Base Severity	HIGH
Confidentiality Impact	HIGH
Integrity Impact	NONE
Privileges Required	NONE
Scope	UNCHANGED
User Interaction	NONE
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability Score	3.9
Impact Score	3.6
Source	[email protected]
Type	Primary

Links:

Exploit-db
Github