Permission Check Flaw in Android Recovery System Allows Unauthorized Factory Reset

CVE-2025-48614

What is CVE-2025-48614?

A security vulnerability exists in the Recovery System of Android devices where a missing permission check in the rebootWipeUserData function could allow unauthorized users to perform a factory reset while the device is in DSU mode. This flaw could potentially lead to a physical denial of service, enabling exploitation without requiring additional execution privileges or user interaction. Users should ensure their devices are updated to mitigate this risk.

References