CVE-2019-14326 describes a critical vulnerability in AndyOS Andy versions up to 46.11.113, where the emulated Android system defaults to running Telnet and SSH services with root privileges. This flaw allows remote attackers to gain full root access to the device without authentication, or enables malicious apps within the emulator to escalate privileges. The vulnerability carries a CVSS v3.1 score of 7.8 (High), indicating a significant risk due to its low attack complexity (AV:L/AC:L) and the potential for complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The primary attack vector involves local access, either directly or via malicious applications. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 46.11.113CPE matchmatch criteria | cpe:2.3:o:andyroid:andy_os:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.