CVE-2022-23729
📋 TL;DR
This vulnerability allows attackers to access the Android Debug Bridge (ADB) shell on LG mobile devices without authentication when the device is in factory state. This affects LG mobile devices that haven't been properly configured after initial setup. Attackers with physical access or network access to the device can exploit this.
💻 Affected Systems
- LG mobile devices
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing installation of malware, data theft, and persistent backdoor access to the device.
Likely Case
Unauthorized access to device shell leading to data extraction, privilege escalation, or installation of malicious applications.
If Mitigated
Limited impact if devices are properly configured and not left in factory state after initial setup.
🎯 Exploit Status
Exploitation requires physical access or network access to the device while it's in factory state. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: https://lgsecurity.lge.com/bulletins/mobile
Restart Required: Yes
Instructions:
1. Check LG security bulletins for specific patch information. 2. Update affected LG mobile devices to the latest firmware. 3. Ensure devices are properly configured after initial setup.
🔧 Temporary Workarounds
Disable ADB in factory state
androidConfigure devices to require ADB authentication even in factory state
adb shell settings put global adb_enabled 0
Complete device setup
allEnsure all devices are fully configured and out of factory state before deployment
🧯 If You Can't Patch
- Physically secure devices to prevent unauthorized access during initial setup
- Ensure devices are never left in factory state in accessible locations
🔍 How to Verify
Check if Vulnerable:
Check if ADB shell is accessible without authentication on a device in factory state using: adb connect <device_ip>Check Version:
adb shell getprop ro.build.version.incrementalVerify Fix Applied:
Attempt ADB connection without authentication after applying updates - should require authentication📡 Detection & Monitoring
Log Indicators:
- Unauthorized ADB connection attempts
- ADB shell access without authentication logs
Network Indicators:
- ADB protocol traffic (port 5555) to devices in factory state
SIEM Query:
source="android_logs" AND "adb" AND "unauthorized" OR "factory state"