CVE-2024-11624
Published: 03 January 2025
Summary
CVE-2024-11624 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-19 (Access Control for Mobile Devices) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-11624 is a vulnerability in Android Pixel devices caused by an undeclared permission that allows apps to bypass VPN configurations. This flaw, classified under CWE-276 (Incorrect Default Permissions), enables local escalation of privilege without needing additional execution privileges or user interaction. It received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on January 3, 2025.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation leads to high-impact confidentiality, integrity, and availability violations, allowing the attacker to escalate privileges on the affected device.
The Android security bulletin for Pixel devices, dated December 1, 2024 (available at https://source.android.com/security/bulletin/pixel/2024-12-01), addresses this vulnerability with patches for mitigation. Security practitioners should ensure affected Pixel devices are updated to the patched firmware versions outlined in the bulletin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34185
Vulnerability details
there is a possible to add apps to bypass VPN due to Undeclared Permission . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via permission bypass on Android matches Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for access, addressing the undeclared permission that allows apps to bypass VPN and escalate privileges.
Establishes usage restrictions and access controls specifically for mobile devices like Android Pixel, mitigating permission-based bypasses on such platforms.
Employs least privilege to restrict low-privilege apps from escalating via VPN bypass, limiting the impact of the vulnerability.