CVE-2019-2041

HIGH

Android 8.1-9 - Local Privilege Escalation via Insecure NFC Device Default Configuration

Title source: llm

Description

In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-8.1 Android-9. Android ID: A-122034690.

References (1)

Core 1

Core References

Patch, Vendor Advisory x_refsource_confirm

https://source.android.com/security/bulletin/2019-04-01

Scores

CVSS v3 7.3

EPSS 0.0019

EPSS Percentile 8.5%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-1188

Status published

Products (2)

google/android 8.1

google/android 9.0

Published Apr 19, 2019

Tracked Since Feb 18, 2026