CVE-2023-47355
📋 TL;DR
This vulnerability in the Quick Reboot Android app allows unauthorized apps to send broadcast intents that trigger device power actions without user consent. Any Android device running version 1.0.8 of the com.eypcnnapps.quickreboot app is affected. The exposed broadcast receivers lack input validation, enabling malicious apps to force device reboots, shutdowns, or recovery mode activation.
💻 Affected Systems
- com.eypcnnapps.quickreboot (Quick Reboot)
📦 What is this software?
Root Quick Reboot by Eyuepcanyilmaz
⚠️ Risk & Real-World Impact
Worst Case
Malicious app could repeatedly reboot or shut down the device, causing denial of service, data loss, or preventing legitimate use of the device.
Likely Case
Malware or malicious apps could trigger unwanted reboots or shutdowns, disrupting user activities and potentially causing data corruption.
If Mitigated
With proper Android permission controls and app isolation, impact would be limited to denial of service from the specific vulnerable app.
🎯 Exploit Status
Exploitation requires creating a malicious Android app that sends broadcast intents to the vulnerable receivers. No authentication or special permissions needed beyond basic app installation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Uninstall the vulnerable app version 1.0.8. 2. Check Google Play Store for updated version if available. 3. If no update exists, find alternative reboot utility apps.
🔧 Temporary Workarounds
Uninstall vulnerable app
androidRemove the Quick Reboot app version 1.0.8 from affected Android devices
adb uninstall com.eypcnnapps.quickreboot
Disable broadcast receivers via ADB
androidTemporarily disable the vulnerable broadcast receivers using Android Debug Bridge
adb shell pm disable-user --user 0 com.eypcnnapps.quickreboot
🧯 If You Can't Patch
- Remove the Quick Reboot app completely from all devices
- Use Android's built-in reboot functionality or alternative trusted reboot apps
🔍 How to Verify
Check if Vulnerable:
Check installed apps list for 'com.eypcnnapps.quickreboot' version 1.0.8 via Settings > Apps or using 'adb shell dumpsys package com.eypcnnapps.quickreboot | grep versionName'Check Version:
adb shell dumpsys package com.eypcnnapps.quickreboot | grep versionNameVerify Fix Applied:
Confirm app is no longer installed or version is different from 1.0.8📡 Detection & Monitoring
Log Indicators:
- Logcat entries showing broadcast intents to com.eypcnnapps.quickreboot.widget.PowerOff, Reboot, or Recovery receivers from unexpected sources
Network Indicators:
- Not applicable - local vulnerability only
SIEM Query:
Not applicable for local Android app vulnerability