Critical severity · published Nov 3, 2023
CVE-2023-36621
An issue was discovered in the Boomerang Parental Control application through 13.83 for Android
9.1
CVSS
1.1%
EPSS
No
On KEV
Description
An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Boomerang · Nationaledtech
before 13.83 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-36621
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-36621
Third Party Advisory
https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/
Mailing List
https://seclists.org/fulldisclosure/2023/Jul/12
Product
https://useboomerang.com/
More from Boomerang
4.6
CVE-2023-36620
An issue was discovered in the Boomerang Parental Control application before 13.83 for Android