EUVD-2025-201737

| CVE-2025-48633 MEDIUM
2025-12-08 [email protected]
5.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201737
Patch Released
Mar 15, 2026 - 17:54 nvd
Patch available
Added to CISA KEV
Dec 10, 2025 - 02:00 cisa
CISA KEV
CVE Published
Dec 08, 2025 - 17:16 nvd
MEDIUM 5.5

Tags

Privilege Escalation Android Google

Description

In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Analysis

CVE-2025-48633 is a security vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed). Vendor patch is available.

Technical Context

Vulnerability type not specified by vendor.

Affected Products

['Unspecified product']

Remediation

Apply the vendor-supplied patch immediately. This is CISA KEV-listed — federal agencies must remediate per BOD 22-01 deadlines.

Priority Score

78
Low Medium High Critical
KEV: +50
EPSS: +0.2
CVSS: +28
POC: 0

Share

EUVD-2025-201737 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy