Security readout for executives and security teams
Plain-English summary
CVE-2017-13268 is an Android Bluetooth information disclosure issue. The public record identifies affected Android versions from 5.1.1 through 8.1, but does not explain what data could be exposed or the attack conditions. Treat it as a legacy Android fleet exposure until device patch levels are verified.
Executive priority
Prioritize as an asset hygiene and legacy mobile risk item, not as a confirmed emergency. The main business concern is unpatched or unsupported Android devices handling sensitive data while details about exploitability remain limited.
Technical view
The CVE describes an information disclosure vulnerability in the Android system Bluetooth component, tracked by Android ID A-67058064. Affected versions listed are Android 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, and 8.1. No CVSS, CWE, exploit vector, or detailed root cause is provided.
Likely exposure
Exposure is most likely in older Android or Pixel devices still running affected platform versions or missing relevant 2018 security updates. Enterprise risk depends on device inventory, patch level, Bluetooth usage, and whether unsupported devices remain in service.
Exploitation context
The provided sources do not show active exploitation, and the CVE is not marked KEV. They also do not provide exploit mechanics or preconditions. Do not assume exploitation in the wild without additional vendor or threat-intelligence evidence.
Researcher notes
Public data is sparse: severity, CVSS, CWE, root cause, and exploitation details are not provided in the supplied bundle. Analysis should stay tied to Android ID A-67058064 and the affected-version list unless additional vendor detail is obtained.
Mitigation direction
- Identify Android devices on versions 5.1.1 through 8.1.
- Verify each device security patch level against vendor guidance.
- Apply available Android or OEM security updates.
- Retire or isolate unsupported devices that cannot be updated.
- Review Bluetooth policy for unmanaged or legacy devices.
Validation and detection
- Inventory Android OS versions and device models.
- Check security patch levels on affected-version devices.
- Confirm OEM support status for each device class.
- Review MDM compliance data for outdated Android builds.
- Document exceptions where updates are unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-13268 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/security/bulletin/pixel/2018-03-01CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.