CVE-2023-47354 is an improper intent verification flaw in Super Reboot (Root) Recovery 1.0.3 for Android. NVD scores it 7.8, High. Another app on the device can send a crafted intent to the PowerOffWidgetReceiver and reset or power off the phone. No fixed version is confirmed, so remove the app or check for an update.
What's affected
The record names Super Reboot version 1.0.3 for Android, package com.bdrm.superreboot, and the PowerOffWidgetReceiver function. The researcher write-up says several actions are exposed through exported broadcast receivers, including reboot, recovery mode, power off and safe mode. No fixed version is named in either source.
The NVD vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, a local attack by an app with low privileges. That matches the write-up, which describes a malicious app on the same device.
The record carries no weakness identifier. The write-up names CWE-925, improper verification of intent by broadcast receiver, and CWE-927, use of implicit intent for sensitive communication.
Source note: the description speaks of arbitrary reset or power off. NVD rates integrity and confidentiality High as well. The write-up only demonstrates availability type effects such as reboots, so the High ratings for confidentiality and integrity are NVD's assessment, not something the write-up shows.
How to check if you're exposed
Open Settings, Apps, then Super Reboot, and read the version. Version 1.0.3 is the one named in the record.
For managed fleets, search the app inventory for the package name com.bdrm.superreboot. An app of this kind needs root, so devices that have it installed are likely rooted. Those devices deserve a wider look, because root access widens what any other app on the device can do.
If you build Android apps yourself, you can look for the same pattern in your own manifest: any receiver marked as exported with no permission attached. That is the shape of this bug.
What to do now
- Uninstall Super Reboot 1.0.3 unless you need it, since I could not confirm a fixed release.
- If you keep it, check Google Play for a newer version and read the notes.
- Review other apps on rooted devices and remove the ones you do not use.
- If you build apps, set exported to false on receivers that only your own app should call, or protect them with a permission, as the researcher recommends.
- Verify the sender inside the receiver's onReceive method before taking any sensitive action.
Why it matters
Android lets apps register broadcast receivers that other apps can call. If a receiver is exported and does not check who is calling, any installed app can trigger it. For a utility whose entire job is rebooting the phone, that means any app can reboot the phone.
The weakness is CWE-925. The effect here is an availability problem, and a modest one for most users: an unwanted reboot or power off. The NVD score of 7.8 is high because the vector assumes full impact, and a tool with root privileges that is exposed this way is a reasonable place to be cautious.
The lesson for anyone shipping Android software is short. Treat every exported component as a public API, and apply the same checks you would apply to a web endpoint. The researcher's recommendations are the standard set: do not export what you do not need to, attach a permission where you must, and verify the sender in code.
Quick check
Does an attacker need physical access?
No. The attack comes from another app on the same device, so the attacker needs a way to get that app installed.
Is there a fixed version?
I could not confirm one from the record or the write-up. Check the app listing.
Sources
- Researcher write-up for Super Reboot 1.0.3
- Super Reboot on Google Play
- Safeguard Gold page for CVE-2023-47354
Last reviewed: 19 October 2026.
