What is the CVSS score of CVE-2025-48633?

CVE-2025-48633 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Android are affected by CVE-2025-48633?

CVE-2025-48633 presents moderate security risk rated CVSS 5.5. Exploitation could compromise the security of affected deployments. This vulnerability is actively exploited in the wild (KEV-listed).. A patch is available.

Is CVE-2025-48633 being actively exploited?

Yes, CVE-2025-48633 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2025-48633?

Within 24 hours: Identify affected systems and apply vendor patches immediately. Vendor patch is available.

Android CVE-2025-48633

EUVD-2025-201737 MEDIUM

2025-12-08 security@android.com

Privilege Escalation Google Android

5.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:54 euvd

EUVD-2025-201737

Analysis Generated

Mar 15, 2026 - 17:54 vuln.today

Patch released

Mar 15, 2026 - 17:54 nvd

Patch available

Added to CISA KEV

Dec 10, 2025 - 02:00 cisa

CISA KEV

CVE Published

Dec 08, 2025 - 17:16 nvd

MEDIUM 5.5

DescriptionNVD

In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

CVE-2025-48633 is a security vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed). Vendor patch is available.

Technical ContextAI

Vulnerability type not specified by vendor.

RemediationAI

Apply the vendor-supplied patch immediately. This is CISA KEV-listed — federal agencies must remediate per BOD 22-01 deadlines.

More from same product – last 7 days

CVE-2026-44739 HIGH This Week

8.7 May 27

SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config

CVE-2026-8842 MEDIUM This Month

6.4 May 27

Stored Cross-Site Scripting in the Google+ Link Name WordPress plugin (versions up to and including 1.0) allows authenti

CVE-2025-68712 MEDIUM This Month

5.5 May 27

Authentication bypass in SpSoft AppLock 7.9.40 for Android allows a local attacker with physical device access to circum

CVE-2026-7552 MEDIUM This Month

5.3 May 28

Authorization bypass in the Geo Mashup WordPress plugin (all versions ≤ 1.13.19) exposes sensitive plugin configuration

CVE-2025-68709 MEDIUM This Month

5.2 May 26

Arbitrary JavaScript execution in SailingLab AppLock 4.3.8 for Android is triggered by a malicious co-installed app send

CVE-2025-48633 vulnerability details – vuln.today

Back

Android CVE-2025-48633

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

More from same product – last 7 days

Share

External POC / Exploit Code