Cyber Resilience

CVE-2023-21109

Crypto Weakness in Google Android 11.0 … 13.0

Crypto Weakness
Published
15 May 2023
Modified
24 January 2025
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2023-21109 is a high-severity Inadequate Encryption Strength (CWE-326) vulnerability in Google Android. Its CVSS base score is 7.8 (High).

Operationally, ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User…

more

interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261589597

CWE(s)
NVD-CWE-noinfoCWE-326

Related Threats

CVEs Like This One

CVE-2023-35693Same product: Google Android
CVE-2026-0157Same product: Google Android
CVE-2023-21162Same product: Google Android
CVE-2023-21402Same product: Google Android
CVE-2023-48398Same product: Google Android
CVE-2023-21035Same product: Google Android
CVE-2023-21098Same product: Google Android
CVE-2024-34733Same product: Google Android
CVE-2025-26438Same product: Google Android
CVE-2024-27228Same product: Google Android

Affected Assets

google
android
11.0, 12.0, 12.1, 13.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 14 hardening rules · 7 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V11.4.2
  • V14.1.2
  • V14.2.4

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

PM-15 Security and Privacy Groups and Associations
addresses: CWE-326

Maintaining currency with technologies and practices reduces selection of encryption mechanisms that provide inadequate strength.

RA-4 Risk Assessment Update
addresses: CWE-326

Updated assessments identify when previously adequate encryption strength no longer meets current attack capabilities or compliance drivers.

SC-12 Cryptographic Key Establishment and Management
addresses: CWE-326

Establishment procedures require selection and generation of keys with adequate length and strength for the chosen algorithm.

SC-13 Cryptographic Protection
addresses: CWE-326

Specifies required cryptography types and parameters, preventing selection of inadequate encryption strength.

SI-2 Flaw Remediation
addresses: CWE-326

Prompt patching corrects inadequate encryption strength when vendors release updates that increase key sizes or algorithm security.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match
prevents

Strong encryption is required to protect confidentiality of data-at-rest.

PR.DS-02 mostly match
prevents

Strong encryption is required to protect confidentiality of data-in-transit.

PR.PS-01 partial match
prevents

Hardened baselines can enforce minimum cryptographic algorithm and key-length settings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography partial match
prevents

Requiring the organization to define and enforce minimum cryptographic strength prevents deployment of insufficient key lengths or weak ciphers that can be brute-forced.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (1 rule)
  • V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. via CWE-326
Oracle Linux 9 (1 rule)
  • V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. via CWE-326
RHEL 8 (1 rule)
  • V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. via CWE-326
RHEL 9 (1 rule)
  • V-257879 RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. via CWE-326
Windows Server 2016 (1 rule)
  • V-224843 Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. via CWE-326
Windows Server 2019 (1 rule)
  • V-205727 Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. via CWE-326
Windows Server 2022 (1 rule)
  • V-254262 Windows Server 2022 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. via CWE-326

References