{"id":"CVE-2026-57013","kind":"vulnerability","aliases":["CVE-2026-57013"],"related":[],"title":"Android: insecure firewall default lets local code release secure coprocessors","description":"In access_control_enable of multiple files, there is a possible way to release secure coprocessors from reset via unclaimed firewall registers due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"Multiple files in access_control_enable leave firewall registers unclaimed by default, so a local attacker can release secure coprocessors from reset. The flaw gives local privilege escalation with System-level execution and needs no user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","embedded","firmware","infrastructure"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:18+00:00","first_seen_at":"2026-11-10T20:46:08+00:00","triaged_at":"2026-11-10T20:52:07+00:00","updated_at":"2026-11-10T20:52:07+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-11-10T20:52:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: insecure firewall default lets local code release secure coprocessors","impact":"high","summary":"Multiple files in access_control_enable leave firewall registers unclaimed by default, so a local attacker can release secure coprocessors from reset. The flaw gives local privilege escalation with System-level execution and needs no user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","embedded","firmware"],"confidence":0.35,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker escalates to System privileges and controls coprocessors","analyst_note":"Identify the affected product and patched build from the NVD entry and vendor bulletin; the description names no product.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The sources do not name the affected product or versions; the description refers only to access_control_enable in multiple files. Systems that ship the affected firmware or Android build are exposed to a local attacker who already runs code with System privileges. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4529,"output_tokens":426,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-57013':13A,16A 'access':24B,60C 'android':1A,17B 'attack':36B 'code':7A 'control':25B,61C 'coprocessor':10A,40B,74C 'could':88C 'cve':11A,14A 'default':4A,32B,85C 'due':81C 'embed':18B 'enabl':26B,62C 'escal':48B,92C 'execut':53B,97C 'exploit':106C 'file':22B,65C 'firewal':3A,28B,79C 'firmwar':19B 'flaw':44B 'give':45B 'infrastructur':20B 'insecur':2A,84C 'interact':58B,101C 'lead':89C 'leav':27B 'let':5A 'level':52B 'local':6A,35B,46B,91C 'multipl':21B,64C 'need':55B,99C,104C 'possibl':69C 'privileg':47B,94C,98C 'regist':29B,80C 'releas':8A,38B,72C 'reset':42B,76C 'secur':9A,39B,73C 'system':51B,96C 'system-level':50B 'unclaim':30B,78C 'user':57B,100C 'valu':86C 'via':77C 'way':70C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product or versions; the description refers only to access_control_enable in multiple files. Systems that ship the affected firmware or Android build are exposed to a local attacker who already runs code with System privileges. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","embedded","firmware","infrastructure","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-57013':13A,16A 'android':1A 'code':7A 'coprocessor':10A 'cve':11A,14A 'default':4A 'firewal':3A 'insecur':2A 'let':5A 'local':6A 'releas':8A 'secur':9A","search_b":"'access':24B 'android':17B 'attack':36B 'control':25B 'coprocessor':40B 'default':32B 'embed':18B 'enabl':26B 'escal':48B 'execut':53B 'file':22B 'firewal':28B 'firmwar':19B 'flaw':44B 'give':45B 'infrastructur':20B 'interact':58B 'leav':27B 'level':52B 'local':35B,46B 'multipl':21B 'need':55B 'privileg':47B 'regist':29B 'releas':38B 'reset':42B 'secur':39B 'system':51B 'system-level':50B 'unclaim':30B 'user':57B","search_c":"'access':60C 'control':61C 'coprocessor':74C 'could':88C 'default':85C 'due':81C 'enabl':62C 'escal':92C 'execut':97C 'exploit':106C 'file':65C 'firewal':79C 'insecur':84C 'interact':101C 'lead':89C 'local':91C 'multipl':64C 'need':99C,104C 'possibl':69C 'privileg':94C,98C 'regist':80C 'releas':72C 'reset':76C 'secur':73C 'system':96C 'unclaim':78C 'user':100C 'valu':86C 'via':77C 'way':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57013","severity":null,"published_at":"2026-11-10T20:19:18+00:00","modified_at":"2026-11-10T20:19:18+00:00","first_seen_at":"2026-11-10T20:46:08+00:00","fetched_at":"2026-11-10T20:46:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}