CVE-2023-21173

MEDIUM

Android 13 - Unauthenticated Local Information Disclosure via DataUsageList.java

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-21173. PoCs published by vesu-nights.

AI-analyzed exploit summary This repository contains a multi-service vulnerability scanner that checks for various vulnerabilities, including CVE-2023-21173 (MSSQL RCE). It performs credential brute-forcing, service enumeration, and checks for misconfigurations but does not include a direct exploit for CVE-2023-21173.

Description

In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262741858

Exploits (1)

nomisec SCANNER
by vesu-nights · poc
https://github.com/vesu-nights/MultiExploit

This repository contains a multi-service vulnerability scanner that checks for various vulnerabilities, including CVE-2023-21173 (MSSQL RCE). It performs credential brute-forcing, service enumeration, and checks for misconfigurations but does not include a direct exploit for CVE-2023-21173.

Classification
Scanner 90%
Attack Type
Info Leak | Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Microsoft SQL Server 2022, FTP Services, WinRM
Auth required
Prerequisites: Network access to target services · Open ports for MSSQL, FTP, or WinRM
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 5.5
EPSS 0.0011
EPSS Percentile 1.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
google/android 13.0
Published Jun 28, 2023
Tracked Since Feb 18, 2026