An improper access control flaw in the Android client of HPE ClearPass Policy Manager allows its functions to be invoked by untrusted sources. This can enable an unauthenticated remote attacker, with user interaction, to retrieve sensitive information from an affected device. The primary impact is the unauthorized disclosure of data that may include credentials or configuration details, exposing users to further compromise.

Hewlett Packard Enterprise ClearPass Policy Manager Android client. All current installations of the Android client are potentially vulnerable, as the CVE does not list specific affected versions; the flaw exists in any released client until a vendor patch is applied.

The vulnerability carries a CVSS score of 8.8, indicating high severity, and an EPSS score of less than 1%, reflecting a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is inferred from the description: an attacker can supply a crafted Android intent or otherwise invoke the client’s exported components, but the exploitation requires the victim to interact with the malicious prompt. Once interaction occurs, the attacker can read sensitive information without authentication or privileges.