Security readout for executives and security teams
Plain-English summary
CVE-2011-2343 is an Android Bluetooth issue affecting Android before 2.3.6. A nearby attacker could obtain contact information through an AT phonebook transfer path. The business risk is mainly for very old Android devices still used in production or retained with sensitive contacts.
Executive priority
Treat this as a legacy-device hygiene issue, not a broad modern Android emergency. Prioritize confirming whether obsolete Android devices still exist in business workflows, then retire or isolate them.
Technical view
The provided CVE record describes an information disclosure flaw in the Android Bluetooth stack before 2.3.6. The exposure requires physical proximity and targets contact information via AT phonebook transfer. The bundle does not provide CVSS, CWE, detailed exploit mechanics, or a vendor advisory with explicit remediation steps.
Likely exposure
Exposure is likely limited to legacy Android 2.3-era devices with Bluetooth capability and contact data. Modern Android fleets are unlikely to be affected unless old devices remain unmanaged, embedded, or operationally reused.
Exploitation context
The source bundle does not show KEV listing or active exploitation evidence. Practical exploitation would require a physically proximate attacker and an affected Android version. No weaponized details are included in the provided sources.
Researcher notes
Evidence is sparse in the provided bundle. The record identifies Android before 2.3.6 and Bluetooth contact disclosure, but provides no CVSS, CWE, patch advisory details, or active exploitation confirmation. Avoid expanding affected scope beyond legacy Android.
Mitigation direction
- Inventory Android devices and retire versions earlier than 2.3.6.
- Upgrade affected devices to supported firmware where available.
- Disable Bluetooth on legacy devices that cannot be upgraded.
- Remove sensitive contacts from unsupported legacy devices.
- Check OEM or Google guidance before relying on compensating controls.
Validation and detection
- Confirm whether any managed devices run Android earlier than 2.3.6.
- Review MDM, asset, and procurement records for legacy Android hardware.
- Verify Bluetooth status and contact storage on any legacy devices found.
- Document whether affected devices are production, lab, or decommissioned assets.
- Track exceptions for devices that cannot be upgraded or retired.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2011-2343 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://code.google.com/p/android/issues/detail?id=21347CVE reference · x_refsource_CONFIRM
- https://deepsec.net/docs/Slides/2013/DeepSec_2013_Jaime_Sanchez_-_Building_The_First_Android_IDS_On_Network_Level.pdfCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.