Login Sign Up

CVE-2025-48633

5.5 MEDIUM CISA KEV

📋 TL;DR

This vulnerability in Android's DevicePolicyManagerService allows an attacker to add a Device Owner after device provisioning due to a logic error. This enables local privilege escalation without requiring additional execution privileges or user interaction. Affects Android devices with vulnerable versions of the Device Policy Manager service.

💻 Affected Systems

Products:
  • Android
Versions: Android versions prior to December 2025 security patch
Operating Systems: Android
Default Config Vulnerable: ⚠️ Yes
Notes: Affects devices using Device Policy Manager service. Enterprise-managed devices may be at higher risk.

📦 What is this software?

Android by Google

View all CVEs affecting Android →

Android by Google

View all CVEs affecting Android →

Android by Google

View all CVEs affecting Android →

Android by Google

View all CVEs affecting Android →

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker gains Device Owner privileges, allowing complete device control including data wiping, app installation/removal, policy enforcement, and potential data exfiltration.

🟠

Likely Case

Malicious apps or local attackers gain elevated privileges to modify device policies, potentially compromising corporate-managed devices or personal data.

🟢

If Mitigated

With proper device management and security policies, impact is limited to isolated devices with minimal data exposure.

🌐 Internet-Facing: LOW - Exploitation requires local access to the device, not remote network access.
🏢 Internal Only: MEDIUM - Requires physical or local access to vulnerable Android devices within an organization.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires local access but no user interaction. Listed in CISA's Known Exploited Vulnerabilities catalog.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: December 2025 Android Security Patch or later

Vendor Advisory: https://source.android.com/security/bulletin/2025-12-01

Restart Required: Yes

Instructions:

1. Check for Android system updates in Settings > System > System update. 2. Apply December 2025 or later security patch. 3. Reboot device after installation.

🔧 Temporary Workarounds

Disable Device Policy Manager for non-enterprise devices

android

Remove or disable Device Policy Manager service on devices not requiring enterprise management

adb shell pm disable com.android.managedprovisioning

🧯 If You Can't Patch

  • Restrict physical access to vulnerable devices
  • Implement strict app installation policies and monitor for suspicious Device Owner changes

🔍 How to Verify

Check if Vulnerable:

Check Android security patch level in Settings > About phone > Android version. If before December 2025, device is vulnerable.

Check Version:

adb shell getprop ro.build.version.security_patch

Verify Fix Applied:

Verify security patch level shows December 2025 or later. Check Device Policy Manager service is functioning normally.

📡 Detection & Monitoring

Log Indicators:

  • Unexpected Device Owner changes in system logs
  • DevicePolicyManagerService exceptions or errors

Network Indicators:

  • Unusual device management server communications

SIEM Query:

source="android_system" AND ("DeviceOwner" OR "DevicePolicyManager") AND ("added" OR "changed" OR "privilege")

📊 Metadata

CVE ID: CVE-2025-48633
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score: 0.18% exploit probability (39.9th percentile)
CISA KEV: Actively Exploited added Dec 2, 2025
Published: December 8, 2025
Last Updated: December 10, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON