What is CVE-2023-36621?

CVE-2023-36621 is a critical-severity vulnerability in Nationaledtech Boomerang, classified under Missing Authorization. CVSS score: 9.1/10. Published 2023-11-03.

How severe is CVE-2023-36621?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Auth bypass in Nationaledtech Boomerang

CVE-2023-36621

An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing.

Vulnerability class: Broken Access Control

EPSS: 0.011 (62.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Affected products

Nationaledtech Boomerang
N/a — versions n/a

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cve@mitre.org (Third Party Advisory)
cve@mitre.org (Product)
cve@mitre.org (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2023-36621?: CVE-2023-36621 is a critical-severity vulnerability in Nationaledtech Boomerang, classified under Missing Authorization. CVSS score: 9.1/10. Published 2023-11-03.
How severe is CVE-2023-36621?: Critical severity. CVSS v3 base score is 9.1 out of 10.