7.8

CVE-2025-48558

EPSS 0.01%
Veröffentlicht 04.09.2025 18:34:35
Zuletzt bearbeitet 05.09.2025 19:02:24
Quelle security@android.com
CVE-Watchlists
Login
Unerledigt
Login

In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 5

NVD 4 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Android Version13.0

Google ≫ Android Version14.0

Google ≫ Android Version15.0

Google ≫ Android Version16.0

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.01%	0.005

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-927 Use of Implicit Intent for Sensitive Communication

The Android application uses an implicit intent for transmitting sensitive data to other applications.

https://source.android.com/security/bulletin/2025-09-01

Vendor Advisory

https://android.googlesource.com/platform/frameworks/base/+/0d30c78c8953adfc969a8dba8a58a8ea3571908c

Patch

https://nvd.nist.gov/vuln/detail/CVE-2025-48558

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-48558

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-48558

EUVD