CVE-2024-34722
HIGHGoogle Android - Authentication Bypass
Title source: ruleDescription
In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Scores
CVSS v3
8.8
EPSS
0.0019
EPSS Percentile
40.7%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-303
Status
published
Affected Products (4)
google/android
google/android
google/android
google/android
Timeline
Published
Jul 09, 2024
Tracked Since
Feb 18, 2026