CVE-2017-0785

This is a flaw in older Android Bluetooth software. If a person nearby has Bluetooth access, they may be able to pull certain private information from your phone without you clicking or approving anything.

Think of it like leaving a side door unlocked on your office building: someone standing nearby could peek inside (without breaking in), but they still have to be close enough to reach it.

This matters if your business uses Android phones running older Android versions such as 4.4.4 through 8.0. The issue is triggered by a nearby attacker when Bluetooth is enabled—there’s no need for the victim to interact.

Reachability depends on physical proximity (wireless range) and whether Bluetooth is turned on; this is only a risk when an attacker can get close enough and the device has Bluetooth enabled.

This should be treated as a medium-priority fix for any affected devices because an attacker nearby can read confidential data without user interaction. The verdict for this issue is AMBER, meaning it’s important to address, especially for devices that can be in shared spaces.

Fixing it is urgent for any company phones that run the affected Android versions and regularly have Bluetooth enabled in public or crowded areas.

1. Confirm exposure (device inventory)

   • List all company-owned (and possibly company-used) Android devices.
   • For each device, record:
     • Android version (must match one of: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0).
     • Security patch level (check the setting that shows “Android security patch level” / “Build number / patch level”).

2. Check whether the fix is present

   • Use the Android Security Bulletin dated 2017-09-01 as the reference point for remediation.
   • If your device’s security patch level is older than 2017-09-01, it may still be vulnerable.
   • If your device is already on the 2017-09-01 security bulletin fix (or later), it should be covered per the vendor remediation.

3. Upgrade plan

   • Upgrade each affected device to a newer Android build that includes the remediation from the 2017-09-01 bulletin.
   • Note: the exact “fixed version number” can vary by device model and manufacturer; what matters is that the security patch includes the bulletin fix.

4. Immediate workaround if patching is delayed

   • Turn off Bluetooth when not actively needed.
   • Avoid leaving Bluetooth enabled in crowded/public locations.
   • If you use Bluetooth for business functions, establish a short-window usage policy (enable only during the task, then disable).

5. What to monitor after changes

   • Confirm devices remain compliant with your security-patch policy (especially after app updates or OS upgrades).
   • Monitor MDM/management reports for devices that fall out of compliance (old patch levels, Bluetooth policy drift).

6. Exploitation status note

   • There is no public exploit code noted in the findings, and it is not listed in CISA KEV.
   • Treat this as a real vulnerability because it allows information disclosure from a nearby attacker with Bluetooth enabled (even without user interaction).

Severity and type: This is an information disclosure issue (CWE-200) in the Android Bluetooth system. The core finding states the attacker can read confidential information.

Trigger/attack vector: The attack is unauthenticated and requires no user interaction; it works over an adjacent wireless/nearby scenario when the attacker is within wireless range and the victim has Bluetooth enabled.

Affected versions: Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0.

Exploit maturity: No public exploit code was found in the provided findings, and it is not in CISA KEV.

Fix information: Vendor remediation is tied to the Android security bulletin dated 2017-09-01.

EPSS (public-facing): A predicted likelihood exists in the findings, but because KEV/news exploitation is not confirmed in the findings set, it should not be treated as evidence of active exploitation.

Why KEV isn’t driving this one: KEV is not listed for this issue in the provided findings, so the urgency is based on the vulnerability’s exposure mechanism and the AMBER verdict rather than confirmed mass exploitation.