CVE-2020-0394
HIGHAndroid - Privilege Escalation
Title source: llmDescription
In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege and untrusted devices accessing contact lists with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-155648639
Exploits (4)
gitlab
WRITEUP
by pazhanivel07 · poc
https://gitlab.com/pazhanivel07/Settings_10-r33_CVE-2020-0394_02
nomisec
WORKING POC
by pazhanivel07 · poc
https://github.com/pazhanivel07/Settings_10-r33_CVE-2020-0394_02
nomisec
WORKING POC
by pazhanivel07 · poc
https://github.com/pazhanivel07/Settings_10-r33_CVE-2020-0394
nomisec
WORKING POC
by ShaikUsaf · poc
https://github.com/ShaikUsaf/packages_apps_settings_AOSP10_r33_CVE-2020-0394
Scores
CVSS v3
7.8
EPSS
0.0001
EPSS Percentile
1.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-1188
CWE-1021
Status
published
Products (4)
google/android
8.0
google/android
8.1
google/android
9.0
google/android
10.0
Published
Sep 17, 2020
Tracked Since
Feb 18, 2026