Security readout for executives and security teams
Plain-English summary
CVE-2017-13287 is an Android local privilege-escalation issue in credential verification parcel handling. A flaw in input validation could let a local attacker gain higher privileges without user interaction. The sources name Android 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, and 8.1. No active exploitation is identified in the provided sources.
Executive priority
This is mainly a legacy Android fleet risk. Prioritize if the organization still permits older Android devices with enterprise access. It is less urgent than known-exploited remote issues, but unmanaged legacy devices can convert local access into higher device privileges.
Technical view
The issue is in VerifyCredentialResponse.java createFromParcel, where improper input validation can cause an invalid Parcel read when mPayload written by writeToParcel is null. The CVE describes local escalation of privilege with no additional execution privileges and no user interaction required. Android ID is A-71714464.
Likely exposure
Exposure is most likely on Android devices running the listed affected versions that have not received the relevant Android/OEM security updates from April 2018 or later. Enterprise risk depends on remaining legacy Android inventory and patch governance.
Exploitation context
The provided sources describe local privilege escalation, not remote compromise. They do not list public exploitation, KEV inclusion, exploit maturity, or observed attacks. Treat exploitation evidence as incomplete rather than absent.
Researcher notes
Sources provide the affected versions, Android component location, local privilege-escalation impact, and Android bug ID. They do not provide CVSS, CWE, code details beyond the invalid Parcel read condition, exploit status, or device-specific OEM patch mapping.
Mitigation direction
- Identify Android devices running 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, or 8.1.
- Apply vendor or OEM Android security updates covering the April 2018 bulletin.
- Retire or isolate devices that cannot receive vendor security updates.
- Prioritize managed devices with sensitive apps, credentials, or privileged enterprise access.
Validation and detection
- Check device Android version and security patch level in MDM or endpoint inventory.
- Confirm vendor firmware includes the April 2018 Android security bulletin fixes.
- Review legacy Android exceptions and compensating controls for unsupported devices.
- Verify no unsupported affected versions remain in high-trust environments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-13287 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/security/bulletin/2018-04-01CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.