TI-2024-25549 Aliases CVE-2024-38271 GHSA-6pfp-pc86-29qj

Denial of Service in Quick Share

LOW 28CWE-404Published 2024-06-26 · Updated 2024-08-02

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: Active
Attack complexity: High
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-404.

Summary

There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As part of the sequence of packets in a Quick Share connection over Bluetooth, the attacker forces the victim to connect to the attacker’s WiFi network and then sends an OfflineFrame that crashes Quick Share. This makes the Wifi connection to the attacker’s network last, instead of returning to the old network when the Quick Share session completes, allowing the attacker to be a MiTM. We recommend upgrading to version 1.0.1724.0 of Quick Share or above

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00225 13th percentileScored 2026-11-07

Fix Fixed Nearby (Google): 1.0.1724.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Google	Nearby	before 1.0.1724.0	1.0.1724.0	Patch available	CNA

Nearby VendorGoogle Affected before 1.0.1724.0 Fixed in 1.0.1724.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:google:nearby::::::::	before 1.0.1724.0	Vulnerable	Google

cpe:2.3:a:google:nearby:*:*:*:*:*:*:*:* Versions before 1.0.1724.0 Vulnerable ·Google

Remediation

Fix · CNA Nearby (Google) Fixed in 1.0.1724.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-06-26
Google Nearby 1.0.1724.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2024-25550 Auth Bypass in Quick SharePriority LOW 31
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-38271
2026-10-03 Alias added: GHSA-6pfp-pc86-29qj

References

Patch 4

TI-2024-25550 Auth Bypass in Quick Share CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences