EUVD-2025-210214Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run malicious app on device
-
DeliveryInvoke overrideConfig on CarrierConfigLoader
-
ExploitBypass missing UID authorization check
-
ExecutionApply unauthorized carrier config override
-
ImpactEscalate local privileges / control telephony behavior
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on the device as an app with at least low privileges (CVSS PR:L) that can reach the CarrierConfigLoader.overrideConfig IPC/API path; no user interaction is needed (UI:N) and no additional execution privileges are required per the description. The specific limiting factors are: the attacker must already have an app installed and running on the target Android 17 device (no remote/network vector - AV:L), and the target must be running the vulnerable, unpatched Android 17 build. There is no requirement for a special non-default carrier configuration to be enabled; the missing authorization check is in the platform itself, which raises exposure among affected builds but exploitation is still bounded by the need for a local malicious process. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) describes a locally exploitable, low-complexity flaw that requires the attacker to already run code on the device with some privilege (PR:L), typically as an installed app. All three impact metrics are High and CISA SSVC rates Technical Impact as 'total', reflecting that a successful override subverts security-relevant carrier configuration. However, exploitation-likelihood signals are uniformly low: SSVC Exploitation is 'none', Automatable is 'no', KEV does not list it, no POC is referenced, and EPSS is 0.13% (3rd percentile). This is a genuine defense-in-depth local EoP worth patching in the normal Android bulletin cycle rather than an emergency; the low EPSS and 'none' exploitation status are consistent with each other and with the local-only, privilege-requiring attack surface. Note the vector's PR:L means this is not a fully unauthenticated flaw - a malicious or compromised app is the presumed foothold. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app that runs with ordinary app privileges; the app invokes the unprotected overrideConfig path in CarrierConfigLoader to push carrier configuration it is not authorized to set, elevating its effective control over telephony behavior without any user prompt. No public POC is currently identified, and the local, low-complexity vector means a working exploit would be straightforward to trigger once the code path is reached from an on-device process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Local privilege escalation in Google Android 17 arises in the overrideConfig method of CarrierConfigLoader.java, where a missing UID authorization check lets a low-privileged local application override carrier configuration it should not control. Exploitation requires no user interaction and grants total impact over confidentiality, integrity, and availability of the affected component, but there is no public exploit identified at time of analysis and CISA SSVC rates exploitation as none. EPSS is low (0.13%, 3rd percentile), consistent with a not-yet-exploited local flaw.
RemediationAI
Patch available per vendor advisory: apply the Android security patch level that addresses CVE-2025-48617 as published in the Android Security Bulletin (https://source.android.com/docs/security/bulletin/android-17); on Pixel and OEM devices this means updating to the security patch level that lists this CVE as fixed. Because this is a platform framework fix, no reliable in-app workaround fully closes the missing UID check; compensating controls until patched include restricting installation of untrusted apps (the required local foothold) via managed/enterprise app allowlisting and Play Protect, and using MDM to enforce that only vetted apps can be sideloaded - the trade-off is reduced flexibility for users who install apps outside managed channels. Exact fixed version numbers should be taken from the bulletin rather than assumed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CarrierConfigLoader is the Android telephony framework service responsible for loading and applying carrier-specific configuration (CarrierConfig bundles) that govern operator features such as VoLTE, roaming, emergency numbers, and various radio and UI behaviors. The overrideConfig API is intended to be callable only by privileged or carrier-authorized components, gated by a UID/caller identity check. The root cause is CWE-862 (Missing Authorization): the code fails to correctly validate the calling UID before honoring an override request, so a caller that lacks the required identity can still push configuration overrides. The CPE cpe:2.3:a:google:android identifies the affected component as the Android platform software itself rather than a specific OEM app.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local malicious app foothold gives AV:L/PR:L, low-complexity missing-auth check gives AC:L, and unauthorized carrier config control yields total C/I/A impact within an unchanged scope.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
2DescriptionCVE.org
In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A local privilege escalation flaw in Google Android 17 (CVE-2025-48617) enables malicious applications to gain elevated control over device carrier configurations, potentially compromising the confidentiality, integrity, and availability of sensitive device operations. While no public exploit has been identified at time of analysis, organizations with Android 17 deployments face future risk to their mobile workforce. No patch has been released as of this analysis.
No vendor-released patch identified at time of analysis. Implement MDM policies to restrict third-party app installation; enforce app whitelisting; monitor for suspicious carrier configuration changes; disable unnecessary carrier configuration APIs where operationally feasible; prioritize evaluation of and migration to newer Android versions as patches become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB