{"id":"CVE-2026-57005","kind":"vulnerability","aliases":["CVE-2026-57005"],"related":[],"title":"Android: EuiccPort confused deputy lets remote attacker escalate privilege","description":"In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This could lead to remote escalation of privilege with execution privileges needed. User interaction is for exploitation.","summary":"A confused deputy flaw in the Android EuiccPort.buildUiccAccessRule code lets an app make the system act with rights it should not grant. The description says this can lead to remote privilege escalation, with user interaction needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:17+00:00","first_seen_at":"2026-11-10T20:46:08+00:00","triaged_at":"2026-11-10T20:52:10+00:00","updated_at":"2026-11-10T20:52:10+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:52:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Android: EuiccPort confused deputy lets remote attacker escalate privilege","impact":"high","summary":"A confused deputy flaw in the Android EuiccPort.buildUiccAccessRule code lets an app make the system act with rights it should not grant. The description says this can lead to remote privilege escalation, with user interaction needed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains elevated privileges on the device","analyst_note":"Check the Android security bulletin for the patch level that fixes CVE-2026-57005 and the affected Android versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":4539,"output_tokens":368,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-57005':12A,15A 'act':33B 'android':1A,16B,24B 'app':29B 'attack':7A 'code':26B 'confus':3A,19B,62C,67C 'could':70C 'cve':10A,13A 'deputi':4A,20B,63C,68C 'descript':41B 'due':64C 'escal':8A,49B,74C 'euiccport':2A 'euiccport.builduiccaccessrule':25B,55C 'euiccport.java':57C 'execut':78C 'exploit':85C 'flaw':21B 'grant':39B 'infrastructur':17B 'interact':52B,82C 'lead':45B,71C 'let':5A,27B 'make':30B 'need':53B,80C 'possibl':61C 'privileg':9A,48B,76C,79C 'remot':6A,47B,73C 'right':35B 'say':42B 'system':32B 'user':51B,81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","unknown"],"campaign_type":null,"search_a":"'-2026':11A,14A '-57005':12A,15A 'android':1A 'attack':7A 'confus':3A 'cve':10A,13A 'deputi':4A 'escal':8A 'euiccport':2A 'let':5A 'privileg':9A 'remot':6A","search_b":"'act':33B 'android':16B,24B 'app':29B 'code':26B 'confus':19B 'deputi':20B 'descript':41B 'escal':49B 'euiccport.builduiccaccessrule':25B 'flaw':21B 'grant':39B 'infrastructur':17B 'interact':52B 'lead':45B 'let':27B 'make':30B 'need':53B 'privileg':48B 'remot':47B 'right':35B 'say':42B 'system':32B 'user':51B","search_c":"'confus':62C,67C 'could':70C 'deputi':63C,68C 'due':64C 'escal':74C 'euiccport.builduiccaccessrule':55C 'euiccport.java':57C 'execut':78C 'exploit':85C 'interact':82C 'lead':71C 'need':80C 'possibl':61C 'privileg':76C,79C 'remot':73C 'user':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57005","severity":null,"published_at":"2026-11-10T20:19:17+00:00","modified_at":"2026-11-10T20:19:17+00:00","first_seen_at":"2026-11-10T20:46:08+00:00","fetched_at":"2026-11-10T20:46:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}