Executive Summary

This vulnerability exists in the setUserDisclaimerAcknowledged method of the CarDevicePolicyService.java component. It allows an attacker to bypass the user dialog that normally appears when adding an account to a managed device. The root cause is a missing permission check, which means the system does not properly verify if the action is authorized.

Because of this flaw, an attacker can escalate their privileges locally without needing any additional execution privileges or user interaction.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to local escalation of privilege on a managed device. An attacker could add accounts or perform actions that normally require user consent or higher privileges without triggering the expected user dialog or permission checks.

Since no user interaction or additional execution privileges are needed, it increases the risk of unauthorized access or control over device management features.

Useful 0 Not Useful 0