Possible Security Bypass in NetworkManagementService.java

CVE-2017-13314

What is CVE-2017-13314?

A vulnerability exists in the NetworkManagementService.java within the Android operating system that allows a bypass of security settings. Specifically, the setAllowOnlyVpnForUids method lacks adequate permission checks, which results in the unintended ability for users to access non-VPN networks despite restrictions. This vulnerability does not require any user interaction to exploit and allows local escalation of privilege, compromising the network segregation intended for secure VPN use.

References