{"id":"ASB-A-299633613","details":"In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-299633613","CVE-2025-48599"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"64696810561082008628559458199911444117","length":373},"id":"ASB-A-299633613-346f9cac","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd","target":{"file":"src/com/android/settings/wifi/WifiScanModeActivity.java","function":"createDialog"},"deprecated":false},{"target":{"file":"src/com/android/settings/wifi/WifiScanModeActivity.java"},"deprecated":false,"digest":{"line_hashes":["89376418065807262447808223030731093779","245223663508855083818987235872926520314","185361308249400309827113014171377237734","301007619386576210011837872747415215439","107953047751076758067017671687589631031","168600131244329287626518020324308538823","334366402942684249038487745103254858911","49389187724200439243669305482858509403","270022714606229581118045442983011668791","99495797579039669202823682838789500193","122622744142526859596486861860012572182","157291175614990384870858593243873373942","59620969055057726242319306689531082737","68275933987951957406150266224150448454","239318532479909445987400015032593607107","180166770642520905823190102669083513994","11846326348411623406849527802725139991","80068110662887232852161325181558082896","331787673812818604577590912747645605950","72848376057255200823940538838258269513","192506471539439845641724213960584446713","208837401023542939562145259552944550663","61603809998057729785544299683168331761","152249443256410510551281691779562835317","5094385055108455765049560138984714338","160987810320833315605559502563506053996","181548646181419310594768686991153204687","88728296968983629139458528544804312118","228809379267721086738612532260398970155","52186965110787366096824119911691836666","41731445206662845544983019564872676725","100405455990521186629608743181603008747","37549339332988269387709044132600133252","235471368486425943364986896716100196448","70521497133401826068380567488234520981","33543875593775229356449625031429984847","89017946450876242333870943441406477628","292270081348965487072592109231616770447","132733104563646712537930550813087637504","213731206802248309526621220358360862575","334684211700406494928651775955925528981","313391744054598149159787591906086719643","202668394745659911507472766453371077013","292735851573084854695656415541219018238","224626410932392954299892133560717946311","303695845142257422408569259287348757135","85909635464382419600120913335190012694","291023888780200237785683744573319119687","216556559037406704587250274627605854495","118780248108373891649575380364586316168","258611492791612508990165455962210154149","340003587602330950927957411020607820049","39984497540760544846944916603573097578","13292003060342391469665896966217466316"],"threshold":0.9},"id":"ASB-A-299633613-876e5d21","match_only_versions":["16-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd"},{"exact_target_file_match_only":true,"id":"ASB-A-299633613-ff554823","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd","target":{"file":"src/com/android/settings/wifi/WifiScanModeActivity.java","function":"isGuestUser"},"deprecated":false,"digest":{"function_hash":"188295159672899519304942434192811403587","length":187}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-299633613.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/c8b1a4720a1f38c92ae49b0d156e8fe8ceeac446"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c8b1a4720a1f38c92ae49b0d156e8fe8ceeac446","target":{"file":"src/com/android/settings/wifi/WifiScanModeActivity.java"},"deprecated":false,"digest":{"line_hashes":["49495261199254921952323577008448206907","78016449987601987235791248165404880181","304748368377060064966815848641393205699","268257495089161562332630312097263370617","20084663032027974877644383978751334526","24244162159008669250711786970111926944","128902167704304713786662264768397034737","203742218110522710565404928247286224076","89376418065807262447808223030731093779","192783271548435201179492028009613489935","205590085519228782754809691205375309939","64950636608198087317492626991849203076","309311672629146260666418030897801897204","275061548306180913522711608089488951383","88385865971706246233390319659732845112","67591367833042427268291829365403322585","130811660742352081567886956322758940129","337804296410846834241371898750323520206"],"threshold":0.9},"id":"ASB-A-299633613-da2e5682","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c8b1a4720a1f38c92ae49b0d156e8fe8ceeac446","target":{"file":"src/com/android/settings/wifi/WifiScanModeActivity.java","function":"createDialog"},"deprecated":false,"digest":{"function_hash":"34728420961191027874925828834925442004","length":150},"id":"ASB-A-299633613-fa166c44","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-299633613.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-299633613-40af94bb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/72eed92411b9968aae7dbcf40b32d5018eddae8b","target":{"file":"src/com/android/settings/wifi/WifiScanModeActivity.java","function":"isGuestUser"},"deprecated":false,"digest":{"function_hash":"188295159672899519304942434192811403587","length":187},"exact_target_file_match_only":true},{"digest":{"line_hashes":["72848376057255200823940538838258269513","192506471539439845641724213960584446713","208837401023542939562145259552944550663","216556559037406704587250274627605854495","118780248108373891649575380364586316168","258611492791612508990165455962210154149","340003587602330950927957411020607820049","39984497540760544846944916603573097578","13292003060342391469665896966217466316"],"threshold":0.9},"id":"ASB-A-299633613-75a318df","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/72eed92411b9968aae7dbcf40b32d5018eddae8b","target":{"file":"src/com/android/settings/wifi/WifiScanModeActivity.java"},"deprecated":false},{"id":"ASB-A-299633613-fc38d5f3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/72eed92411b9968aae7dbcf40b32d5018eddae8b","target":{"function":"createDialog","file":"src/com/android/settings/wifi/WifiScanModeActivity.java"},"deprecated":false,"digest":{"function_hash":"64696810561082008628559458199911444117","length":373}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/72eed92411b9968aae7dbcf40b32d5018eddae8b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-299633613.json"}}],"schema_version":"1.9.0"}