Security readout for executives and security teams
Plain-English summary
This CVE describes a privilege escalation flaw in the Broadcom wireless driver used by Android kernel builds. In business terms, a vulnerable mobile device could allow software already running on the device to gain higher privileges. The source bundle does not provide CVSS, detailed impact, or a complete affected device list.
Executive priority
Treat this as a mobile fleet hygiene item unless further intelligence shows exploitation or broader device impact. The main business risk is older Android devices remaining below vendor security patch levels with no practical remediation path.
Technical view
CVE-2017-13161 is an Android kernel elevation-of-privilege issue tied to the Broadcom wireless driver, tracked by Android ID A-63930471 and Broadcom reference BC-V2017092501. The provided sources do not include root cause, attack prerequisites, affected chipsets, or technical patch details.
Likely exposure
Exposure is most likely limited to Android devices whose kernels include the affected Broadcom wireless driver and lack the relevant December 2017-era vendor security update. The bundle does not identify specific device models, chipset versions, or non-Google vendor status.
Exploitation context
The provided data does not show active exploitation, and the CVE is not listed as KEV in the bundle. Because this is an elevation-of-privilege issue, it would generally matter most after an attacker already has code execution or app-level access on a vulnerable device.
Researcher notes
Public detail in the bundle is sparse. Avoid assuming exploitability conditions, affected Broadcom chipsets, or patch mechanics beyond the Android kernel Broadcom wireless driver attribution and the referenced Android Pixel security bulletin.
Mitigation direction
- Check Android or device-vendor guidance for CVE-2017-13161 and BC-V2017092501.
- Apply the relevant Android or Pixel December 2017 security update if applicable.
- Retire or isolate Android devices that cannot receive vendor security updates.
- Prioritize managed devices with Broadcom wireless drivers and older Android kernel patch levels.
Validation and detection
- Inventory Android devices and record OS security patch levels.
- Confirm whether device kernels include Broadcom wireless driver components.
- Compare vendor bulletins against CVE-2017-13161 and Android ID A-63930471.
- Use MDM or asset data to identify unpatched legacy Android devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Privilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-13161 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/security/bulletin/pixel/2017-12-01CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.