CVE-2024-49734 Overview
CVE-2024-49734 is an information disclosure vulnerability in the Android ConnectivityService.java component. A side channel allows a Wi-Fi access point operator to determine which site a connected device is visiting through a Virtual Private Network (VPN). The flaw affects Android 14 and Android 15, and exploitation requires no user interaction or additional execution privileges. Google addressed the issue in the January 2025 Android Security Bulletin.
Critical Impact
A network-adjacent attacker operating a Wi-Fi access point can infer VPN-tunneled browsing destinations, undermining the confidentiality guarantees users expect from a VPN connection.
Affected Products
- Google Android 14.0
- Google Android 15.0
- Devices receiving the January 2025 Android security patch level
Discovery Timeline
- 2025-01-21 - CVE-2024-49734 published to the National Vulnerability Database (NVD)
- 2025-04-22 - Last updated in NVD database
Technical Details for CVE-2024-49734
Vulnerability Analysis
The vulnerability resides in multiple functions of ConnectivityService.java, a core Android system service that manages network connections and routing decisions. The component exposes observable state changes that vary based on the destination a VPN tunnel is communicating with. An attacker operating the underlying Wi-Fi access point can correlate these observable signals with destination identities. This breaks the assumption that VPN encapsulation hides destination metadata from the link-layer network operator. The weakness is categorized as Information Exposure [CWE-200] and is a classic side channel rather than a direct decryption flaw.
Root Cause
The root cause is a design-level information leak in ConnectivityService where per-destination behavior differs in ways observable from outside the VPN tunnel. Because the same underlying physical link carries the encapsulated VPN traffic, timing, size, or state artifacts produced by the service correlate with VPN-tunneled destinations. No memory corruption or authentication failure is involved.
Attack Vector
Exploitation requires the victim device to be associated with a Wi-Fi access point under attacker control or observation. The attacker passively observes traffic patterns and ConnectivityService side effects while the device routes traffic over a VPN. By comparing observed signals against known fingerprints for candidate destinations, the attacker infers which site the victim accessed. The attack is fully remote from the device perspective and requires no user interaction.
No public proof-of-concept code or verified exploit examples are available. See the Android Security Bulletin January 2025 for vendor technical details.
Detection Methods for CVE-2024-49734
Indicators of Compromise
- No reliable host-based indicators exist because the side channel is observed externally by the Wi-Fi access point operator.
- Suspicious or rogue Wi-Fi access points in environments where users rely on VPNs for confidentiality.
- Devices running Android 14 or 15 below the 2025-01-01 security patch level connecting through untrusted wireless networks.
Detection Strategies
- Inventory mobile devices and confirm Android security patch level using mobile device management (MDM) telemetry.
- Flag managed Android endpoints with patch levels older than 2025-01-01 for prioritized remediation.
- Correlate VPN session metadata with wireless network association events to identify high-risk usage patterns.
Monitoring Recommendations
- Monitor MDM reporting for Android build fingerprints and security patch levels across the fleet.
- Track which managed devices connect to non-corporate or unknown SSIDs while VPN policies are enforced.
- Alert on devices that fail to receive the January 2025 or later Android security update within the organization's patch SLA.
How to Mitigate CVE-2024-49734
Immediate Actions Required
- Apply the Android security patch level 2025-01-01 or later on all Android 14 and Android 15 devices.
- Prioritize patching for users who routinely rely on VPNs over untrusted Wi-Fi.
- Communicate the side channel risk to high-value users and require corporate Wi-Fi or cellular data until devices are patched.
Patch Information
Google published fixes for CVE-2024-49734 in the Android Security Bulletin January 2025. Device manufacturers ship the corresponding fix as part of the 2025-01-01 security patch level. Confirm the patch level under Settings > About phone > Android security update on each managed device, or through MDM compliance reporting.
Workarounds
- Restrict device connections to trusted Wi-Fi networks or corporate cellular until the patch is applied.
- Enforce always-on VPN policies in conjunction with network access controls that disallow connection to unmanaged access points.
- Use MDM configuration profiles to block known untrusted SSIDs for sensitive user groups.
# Verify Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2025-01-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
