Android Setup Wizard EUVD-2026-73965

Exploitation requires a low-privilege account or application already executing on the target Android device (PR:L, AV:L) - fully remote exploitation is excluded by the local attack vector. The attacker must be capable of interacting with or triggering Setup Wizard functionality from their local execution context. No user interaction is required (UI:N) and no special timing or race conditions are needed (AC:L), meaning the exploit is mechanically straightforward once local access is obtained. The privilege escalation impact is scoped to the compromised device (S:U). Limiting factors include: the mandatory requirement for prior local code execution, and the dependence on Setup Wizard being reachable in the current device state - devices past initial setup may have reduced exposure depending on whether Setup Wizard retains its elevated permissions post-provisioning.

The CVSS 7.8 score with AC:L and PR:L reflects a straightforward local exploitation path - once a low-privileged foothold exists on the device, the confused deputy attack requires no special timing, race conditions, or additional privileges. The full C:H/I:H/A:H triad represents complete device compromise post-escalation. Against this, the AV:L constraint is a meaningful gate: an attacker must already have code running on the device, ruling out fully remote exploitation. EPSS of 0.11% (2nd percentile) is very low, and no CISA KEV listing exists, together suggesting no observed widespread exploitation at time of analysis. The S:U (unchanged scope) metric confirms the impact stays within the compromised device. Practically, even a mid-sized municipal IT team in kalisz managing an Android fleet should treat this as a standard patch-cycle priority rather than an emergency, given the local-access prerequisite - though organizations with high-value devices in shared or semi-trusted environments should elevate urgency. No conflicting signals are present: CVSS, EPSS, and KEV status are all internally consistent.

An attacker who has obtained a low-privilege shell or malicious app on an Android device exploits the Setup Wizard's elevated network-connection authority to redirect the device onto an attacker-controlled malicious network. Through that network position, the attacker delivers a secondary payload or leverages network-layer attacks to escalate privileges, achieving full device compromise (C:H/I:H/A:H). No public exploit code is known; the AC:L rating suggests a reliable exploit could be developed with moderate reverse-engineering effort against the Setup Wizard component.