Security readout for executives and security teams
Plain-English summary
CVE-2022-48451 is a Unisoc Android Bluetooth service flaw that can crash or disrupt local device service through an out-of-bounds write caused by a race condition. The source says System execution privileges are needed, so exposure appears limited to already highly privileged local contexts. No CVSS score or public active-exploitation evidence is provided.
Executive priority
Treat as a targeted fleet hygiene issue, not an emergency. Prioritize inventory and vendor patch tracking for Unisoc-based Android devices, especially where device availability matters.
Technical view
The issue is an out-of-bounds write in the Bluetooth service caused by a race condition. Reported impact is local denial of service, with System execution privileges required. Listed affected platforms are Unisoc SC9863A, SC9832E, SC7731E, T-series, and S8000 devices running Android 10 through Android 13.
Likely exposure
Exposure is most likely on Android devices using the listed Unisoc chipsets and Android 10, 11, 12, or 13. Unspecified products are not identified as affected in the bundle.
Exploitation context
The bundle does not report active exploitation, and CISA KEV status is false. The privilege requirement materially limits opportunistic abuse, but a privileged local attacker or chained compromise could use the flaw for device disruption.
Researcher notes
Evidence is sparse: no CVSS vector, CWE, patch version, exploit detail, or workaround is provided. Analysis should stay bounded to local denial of service requiring System privileges on the listed Unisoc Android platforms.
Mitigation direction
- Inventory Android devices for the listed Unisoc chipsets and Android versions.
- Check Unisoc and OEM security guidance for firmware or security update availability.
- Apply vendor-validated Android firmware updates when available.
- Prioritize managed or high-value devices that expose Bluetooth in operational settings.
- Monitor vendor advisories because no specific fix detail is included in the bundle.
Validation and detection
- Confirm device model, chipset, and Android version against the affected list.
- Review OEM patch notes for CVE-2022-48451 coverage.
- Verify deployed firmware level after any update.
- Check mobile management telemetry for unusual Bluetooth service crashes.
- Track whether vendor guidance adds CVSS, fix, or workaround details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48451 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.