CVE-2014-8609

Google Android < 4.4.4 - Access Control

Title source: rule
STIX 2.1

Description

The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.

Exploits (3)

nomisec WORKING POC
by ratiros01 · poc
https://github.com/ratiros01/CVE-2014-8609-exploit
nomisec WRITEUP
by MazX0p · poc
https://github.com/MazX0p/CVE-2014-8609-POC
nomisec WORKING POC
by locisvv · poc
https://github.com/locisvv/Vulnerable-CVE-2014-8609

Scores

EPSS 0.0047
EPSS Percentile 64.7%

Details

CWE
CWE-264
Status published
Products (17)
google/android 4.0
google/android 4.0.1
google/android 4.0.2
google/android 4.0.3
google/android 4.0.4
google/android 4.1
google/android 4.1.2
google/android 4.2
google/android 4.2.1
google/android 4.2.2
... and 7 more
Published Dec 15, 2014
Tracked Since Feb 18, 2026