CVE-2021-26280 - Vulnerability Details - OpenCVE

Locally installed application can bypass the permission check and perform system operations that require permission.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00025.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2021-13092	Locally installed application can bypass the permission check and perform system operations that require permission.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.vivo.com/en/support/security-advisory-detail?id=6

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00019}`	epss `{'score': 0.00021}`

Tue, 17 Dec 2024 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 17 Dec 2024 06:45:00 +0000

Type	Values Removed	Values Added
Description		Locally installed application can bypass the permission check and perform system operations that require permission.
Title		Permission bypass vulnerability in permission manager module
Weaknesses		CWE-306
References		https://www.vivo.com/en/support/security-advisory-detail?id=6
Metrics		cvssV3_1 `{'score': 7.9, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Vivo

Published: 2024-12-17T06:27:22.498Z

Updated: 2024-12-17T14:38:18.226Z

Reserved: 2021-01-27T19:41:45.352Z

Link: CVE-2021-26280

Vulnrichment

Updated: 2024-12-17T14:38:10.305Z

NVD

Status : Received

Published: 2024-12-17T07:15:05.343

Modified: 2024-12-17T07:15:05.343

Link: CVE-2021-26280

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-26280", "assignerOrgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "state": "PUBLISHED", "assignerShortName": "Vivo", "dateReserved": "2021-01-27T19:41:45.352Z", "datePublished": "2024-12-17T06:27:22.498Z", "dateUpdated": "2024-12-17T14:38:18.226Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Permission manager module", "vendor": "vivo", "versions": [{"status": "affected", "version": "Versions earlier than Android 10"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Locally installed application can bypass the permission check and perform system operations that require permission.<br>"}], "value": "Locally installed application can bypass the permission check and perform system operations that require permission."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "shortName": "Vivo", "dateUpdated": "2024-12-17T06:27:22.498Z"}, "references": [{"url": "https://www.vivo.com/en/support/security-advisory-detail?id=6"}], "source": {"discovery": "UNKNOWN"}, "title": "Permission bypass vulnerability in permission manager module", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-17T14:37:46.709012Z", "id": "CVE-2021-26280", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-17T14:38:18.226Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-26280", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-17T14:37:46.709012Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-17T14:38:10.305Z"}}], "cna": {"title": "Permission bypass vulnerability in permission manager module", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "vivo", "product": "Permission manager module", "versions": [{"status": "affected", "version": "Versions earlier than Android 10"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.vivo.com/en/support/security-advisory-detail?id=6"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Locally installed application can bypass the permission check and perform system operations that require permission.", "supportingMedia": [{"type": "text/html", "value": "Locally installed application can bypass the permission check and perform system operations that require permission.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "shortName": "Vivo", "dateUpdated": "2024-12-17T06:27:22.498Z"}}}, "cveMetadata": {"cveId": "CVE-2021-26280", "state": "PUBLISHED", "dateUpdated": "2024-12-17T14:38:18.226Z", "dateReserved": "2021-01-27T19:41:45.352Z", "assignerOrgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "datePublished": "2024-12-17T06:27:22.498Z", "assignerShortName": "Vivo"}, "dataVersion": "5.1"}