CVE-2022-20145

published 2022-06-15

CVE-2022-20145: In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack. This could lead to remote…

Priority P2 62 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack. This could lead to remote escalation of privilege if a malicious Wi-Fi AP is used, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-201660636

Affected

6 ranges

Vendor	Product	Version range	Fixed in
google	android	—	—
google	android	—	—
google	android	—	—
platform	frameworks_base	>= 11:0 < 11:2022-06-01	11:2022-06-01
platform	frameworks_base	>= 12L-next:0 < 12L-next:2022-06-01	12L-next:2022-06-01
platform	packages_modules_connectivity	>= 12L-next:0 < 12L-next:2022-06-01	12L-next:2022-06-01

Detection & IOCs extracted from sources · hover to see the quote

• → Vulnerability exists in startLegacyVpnPrivileged method of Vpn.java on Android 11; monitor for unexpected legacy VPN credential retrieval or VPN protocol downgrade events on Android 11 devices ↗
• → Attack vector is a malicious Wi-Fi Access Point triggering a VPN protocol downgrade; monitor for devices connecting to rogue APs followed by VPN renegotiation to weaker protocols ↗
• → No user interaction required for exploitation; treat any anomalous legacy VPN activity on Android 11 (AOSP) as potentially active exploitation of this critical EoP vulnerability ↗

• · Only Android 11 (AOSP) is confirmed affected; Android 10 and earlier or Android 12 and later are not listed as affected versions ↗
• · This is rated CRITICAL severity and classified as an Elevation of Privilege (EoP) vulnerability; prioritize patching Android 11 devices exposed to untrusted Wi-Fi networks ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.