CVE-2022-20145

Name of the Vulnerable Software and Affected Versions Android versions Android-11

Description The issue is related to a protocol downgrade attack in the startLegacyVpnPrivileged component of Vpn.java, which could allow retrieval of VPN credentials. This might lead to remote escalation of privilege if a malicious Wi-Fi access point is used, requiring no additional execution privileges. User interaction is not necessary for exploitation. The vulnerability is associated with inadequate access control, potentially enabling a remote attacker to elevate their privileges.

Recommendations For Android version Android-11, consider restricting access to the startLegacyVpnPrivileged component of Vpn.java until a patch is available. As a temporary workaround, avoid using legacy VPN connections on affected devices until the issue is resolved.