CVE-2026-58870 in Android
Summary
by MITRE • 11/02/2026
In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in the Android framework component WifiP2pServiceImpl.java specifically within the onPersistentGroupsChanged method represents a critical security flaw rooted in insufficient access control mechanisms. This issue stems from a missing permission check that fails to validate whether the calling application possesses the necessary privileges to modify or interact with persistent Wi-Fi Direct group configurations. In secure software design, any operation that alters system state or exposes sensitive configuration data must be gated by explicit authorization checks to ensure only trusted entities can perform such actions. The absence of this validation allows unprivileged applications to invoke methods intended for higher-privilege contexts, effectively bypassing the operating system's security boundaries without requiring elevated execution privileges from the attacker.
From a technical perspective, persistent Wi-Fi Direct groups store network credentials and connection parameters that allow devices to reconnect automatically in the future. These stored configurations often contain sensitive information such as pre-shared keys or SSID details which are critical for maintaining secure wireless communications. When an application can trigger changes to these records without proper authorization, it gains the ability to read, modify, or potentially exfiltrate this data. The flaw is particularly dangerous because it does not require user interaction for exploitation. An attacker can craft a malicious application that silently invokes the affected method in the background, leveraging the system service's default permissions rather than its own limited sandboxed privileges. This characteristic significantly lowers the barrier to entry for attackers and increases the likelihood of successful compromise on targeted devices.
The operational impact of this vulnerability is primarily centered around local information disclosure. By exploiting the missing permission check, an attacker can retrieve details about previously connected Wi-Fi Direct networks, including potentially sensitive network identifiers and security parameters. This exposure aids in further reconnaissance activities where knowledge of nearby networks or device configurations can be used to plan more sophisticated attacks such as man-in-the-middle attempts or social engineering campaigns based on observed connectivity patterns. Furthermore, the ability to modify persistent groups could allow an attacker to inject malicious connection profiles, potentially redirecting traffic through compromised nodes or disrupting legitimate network operations. The lack of user interaction means that these actions can occur silently while the device is in use, making detection difficult for end-users and complicating incident response efforts.
This vulnerability aligns with CWE-284 Improper Access Control as it involves a failure to enforce proper authorization checks before allowing access to sensitive system resources. Additionally, from an adversary tactics perspective, this flaw facilitates Initial Access and Collection phases within the MITRE ATT&CK framework by enabling unauthorized data gathering through local application execution without triggering standard security alerts or requiring user consent. To mitigate this risk, developers must implement rigorous permission verification logic within the onPersistentGroupsChanged method to ensure that only applications with explicitly granted permissions can modify persistent group configurations. This includes verifying both the calling package's signature and its declared permissions against a whitelist of authorized entities before proceeding with any state changes. Regular security audits focusing on inter-process communication boundaries in system services are also recommended to identify similar gaps where implicit trust assumptions might lead to privilege escalation or information leakage scenarios.