EUVD-2026-37575Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall unprivileged app on device
-
DeliveryObtain ITelephony Binder handle
-
ExploitCall setAllowedCarriers with crafted input
-
ExecutionTrigger logic-error authorization bypass
-
ImpactCarrier restrictions cleared on device
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be able to run unprivileged code locally on the Android device - i.e., have a locally installed app (any app, including one with no special permissions) that can reach the PhoneInterfaceManager Binder interface and call setAllowedCarriers. No user interaction, no additional execution privileges, no root, and no carrier-privileged certificate are required, but the device must be running an Android build that ships the vulnerable PhoneInterfaceManager.java logic and has not yet applied the Android 17 bulletin patch level. Limiting factor: the impact is confined to disabling carrier restrictions on that device; it does not on its own yield code execution, data theft, or remote access. |
| Impact | The reported CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N with H impact on both vulnerable and subsequent systems) and the 10.0 score are inconsistent with the description, which explicitly says 'local escalation of privilege' - a local attacker on an Android device, not a network-reachable attacker. This appears to be a scoring error in the source feed: AV should be L, not N, and the cross-system 'subsequent' impacts (SC/SI/SA:H) are not supported by the description, which limits impact to disabling carrier restrictions on the same device. EPSS and KEV are not provided in the input; no POC is referenced, and the only reference is the Android Security Bulletin index page (not a per-CVE advisory yet). Realistic risk is moderate: any installed app could call the vulnerable path to unlock carrier-locked devices, which matters most for carrier-subsidized fleets and MDM-managed devices, but does not give code execution or data theft on its own. |
| Exploit ScenarioDerived | A malicious or trojanized app installed on an Android device (e.g., via sideloading or a Play Store abuse) invokes the telephony manager's setAllowedCarriers path and exploits the logic error to clear the carrier-restriction list, effectively unlocking a carrier-locked or subsidized device without root or user interaction. The unlocked device can then be resold or moved to another carrier, defeating subsidy-lock business controls; no public POC has been referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Local privilege escalation in Google Android's telephony subsystem (PhoneInterfaceManager) allows attackers to disable carrier restrictions without any user interaction or additional execution privileges. The flaw stems from a logic error in the setAllowedCarriers handler and is addressed in the Android Security Bulletin for Android 17. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: apply the Android Security Bulletin for Android 17 (https://source.android.com/docs/security/bulletin/android-17) by updating to a security patch level that includes the fix to PhoneInterfaceManager.setAllowedCarriers. Pixel users should take the next monthly OTA; other OEM users should install the vendor's corresponding monthly patch once available, and MDM administrators should enforce minimum patch-level compliance on managed devices. As a compensating control until patches land, restrict sideloading via Play Protect / MDM app-install policies and audit installed apps for unexpected telephony permission use, recognizing the trade-off that this does not block a malicious app that is already installed from invoking the vulnerable Binder call.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PhoneInterfaceManager.java is the AOSP framework service that exposes telephony APIs (including carrier restriction controls) to apps and system components via Binder IPC. The setAllowedCarriers method is intended to be gated so that only privileged callers (carrier-privileged apps or system UID) can modify which carriers a device is allowed to use - a control used to enforce SIM-lock/carrier-lock policies on subsidized or operator-locked devices. A logic error in this permission/validation path lets an unprivileged local caller bypass the intended gate and clear or alter the allowed-carrier list. Affected CPE is cpe:2.3:a:google:android (versions unspecified in the feed), with the fix shipped in the Android 17 security bulletin. No CWE is assigned, but the behavior is consistent with CWE-285 (Improper Authorization) / CWE-863 (Incorrect Authorization).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Local attack via an installed app (AV:L, PR:L, UI:N); logic error reliably triggered (AC:L); integrity of carrier-restriction state is broken (I:H) with no confidentiality or availability impact and no scope change.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
DescriptionCVE.org
In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android 17 devices contain a critical local privilege escalation in the telephony subsystem allowing attackers to disable carrier restrictions without user interaction; no public exploit currently identified. Organizations with Android device deployments face material security risk to network integrity and carrier-enforced controls, particularly those in regulated industries. The lack of a vendor patch requires immediate device inventory and interim protective measures.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict physical and local device access through location and personnel controls; deploy MDM to enforce policies and monitor telephony changes; maintain current device inventory and configurations for rapid patching; disable unnecessary local debugging or administrative access where feasible; implement monitoring for unauthorized carrier restriction modifications; document baseline carrier settings for anomaly detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB