CVE-2019-14326

An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23) with root privileges in the emulated Android system. This can be exploited by remote attackers to gain full access to the device, or by malicious apps installed inside the emulator to perform privilege escalation from a normal user to root (unlike with standard methods of getting root privileges on Android - e.g., the SuperSu program - the user is not asked for consent). There is no authentication performed - access to a root shell is given upon a successful connection. NOTE: although this was originally published with a slightly different CVE ID number, the correct ID for this Andy vulnerability has always been CVE-2019-14326.

• CWE-276

• https://github.com/seqred-s-a/cve-2019-14326Exploit, Third Party Advisory
• https://seqred.pl/en/cve-privilege-escalation-in-andy/Exploit, Third Party Advisory
• https://github.com/seqred-s-a/cve-2019-14326Exploit, Third Party Advisory
• https://seqred.pl/en/cve-privilege-escalation-in-andy/Exploit, Third Party Advisory

Published

Apr 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14317wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as C…5.3
• CVE-2019-14318Crypto++ 8.3.0 and earlier contains a timing side channel in…
• CVE-2019-14319The TikTok (formerly Musical.ly) application 12.2.0 for Andr…
• CVE-2019-1432An information disclosure vulnerability exists when DirectWr…6.5
• CVE-2019-14322In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mish…7.5
• CVE-2019-14323SSDP Responder 1.x through 1.5 mishandles incoming network m…7.5
• CVE-2019-14327A CSRF vulnerability in Settings form in the Custom Simple R…
• CVE-2019-14328The Simple Membership plugin before 3.8.5 for WordPress has …
• CVE-2019-14329An issue was discovered in EspoCRM before 5.6.6. There is st…
• CVE-2019-1433An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2019-14330An issue was discovered in EspoCRM before 5.6.6. Stored XSS …
• CVE-2019-14331An issue was discovered in EspoCRM before 5.6.6. Stored XSS …