CVE-2016-2060 describes a critical vulnerability in the tethering controller (server/TetherController.cpp) of netd, affecting Android devices utilizing Qualcomm Innovation Center (QuIC) contributions. This flaw allows attackers to bypass access restrictions by manipulating upstream interface names through a crafted application. With a CVSS v3 score of 7.8 (High), the vulnerability has a low attack complexity and requires user interaction (UI:R), but could lead to high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). While not listed in CISA's KEV catalog and lacking public exploit code in Metasploit, Nuclei, or ExploitDB, there is significant community discussion and media coverage, including reports of a critical vulnerability affecting a large percentage of Android devices.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.0.1CPE matchmatch criteria | cpe:2.3:o:google:android:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.