CVE-2023-47355 is an input validation flaw in the Root Quick Reboot app, version 1.0.8 for Android. NVD scores it 7.5, High. Exposed broadcast receivers for power off, reboot and recovery can be triggered by other apps because of missing validation. No fixed version is confirmed, so remove the app or check for an update.
What's affected
The record names com.eypcnnapps.quickreboot version 1.0.8 for Android. The exposed receivers include PowerOff, Reboot and Recovery. The researcher write-up says the app has several exported receivers, including SystemUI, and that they lack permission checks. No fixed version appears in either source.
Source conflict on the attack path: NVD uses CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, a network attack with no privileges. The write-up describes a different route: any installed app, even one with no special permissions, or a person using the Android Debug Bridge locally. The impact in both is availability only, a denial of service by forced reboot or power off. NVD records no confidentiality or integrity impact, which matches the write-up.
The record lists CWE-20, improper input validation. The write-up's file name refers to CWE-925, improper verification of intent by broadcast receiver. Both describe the same missing check.
How to check if you're exposed
Open Settings, Apps, then the Quick Reboot app, and read the version. Version 1.0.8 is the one in the record. The package name to look for in an inventory is com.eypcnnapps.quickreboot.
If you develop Android apps, search your own manifest for receivers marked exported without a permission. This bug has that shape, and it is simple to look for. Linting tools in Android Studio flag many of these cases.
I am not providing a command line check, because the output varies across Android versions and device policies.
What to do now
- Uninstall the app if you do not need it, as I could not confirm a patched release.
- If you keep it, check Google Play for a newer version and read the release notes.
- Limit installs on the device to apps from the official store.
- If you ship similar tools, remove the exported flag from receivers that only your app should call, or require a permission, as the researcher advises.
- Add input and sender checks inside each receiver before it acts.
Why it matters
The app does what its name says, and so can anything else on the phone. A broadcast receiver that is exported and unchecked treats every sender as trusted. The researcher notes there is a check for a specific action string in one receiver, but no evident permission check, so the string works like a password that every app can read from the package.
The weakness is CWE-20 in NVD's wording, and a missing intent check in the researcher's. The impact is limited to availability. A forced reboot is annoying on a personal phone and more serious on a device used for a job, such as a handheld in a warehouse or a phone used for two factor codes at the wrong moment.
For defenders, the practical point is inventory. Utility apps that need root are rarely in the software list anyone watches. If you manage devices, know which ones run apps of this kind.
Quick check
Can this expose my data?
NVD records an availability impact only, no confidentiality or integrity impact. The write-up shows forced reboots and power off.
Does an attacker need to be on my network?
NVD's vector says network, but the write-up describes other apps on the device or local debug access. Check both readings when you assess your risk.
Sources
- Researcher write-up for Quick Reboot 1.0.8
- Quick Reboot on Google Play
- Safeguard Gold page for CVE-2023-47355
Last reviewed: 19 October 2026.
