OpenControls Logo

STIG Viewer

STIGViewer Support

Google Android 15 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-267447GOOG-15-008700SV-267447r1033115_ruleCCI-001443medium
Description
If no authentication is required to establish personal hotspot connections (Wi-Fi and Bluetooth), an adversary may be able to use that device to perform attacks on other devices or networks without detection. A sophisticated adversary may also be able to exploit unknown system vulnerabilities to access information and computing resources on the device. Requiring authentication to establish personal hotspot connections mitigates this risk. Application note: If hotspot functionality is permitted, it must be authenticated via a preshared key. There is no requirement to enable hotspot functionality, and it is recommended this functionality be disabled by default. SFRID: FMT_SMF.1.1 #41
STIGDate
Google Android 15 COBO Security Technical Implementation Guide2026-02-06

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-15.1Authentication & Encryption
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (6) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-18(1)Authentication and Encryption
1.00
AC-3Access Enforcement
1.00
CM-7Least Functionality
1.00
SC-8Transmission Confidentiality and Integrity
1.00
SC-8(1)Cryptographic Protection
1.00
NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.17
1.00
CCI1 mapping
CCI-001443
1.00

Details

Check Text (C-267447r1033115_chk)

This is a User-Based Enforcement (UBE) control. Check a sample of Pixel phones at the site and verify the Wi-Fi hotspot preshared key (password) is set to "WPA2/WPA3-Personal" or "WPA3-Personal". 1. Go to Settings >> Network & Internet >> Hotspot & tethering. 2. Enable "Wi-Fi hotspot". 3. Tap on the words to the left of the slide called "Wi-Fi Hotspot" to show the configuration options. 4. Click the "Security" link and verify either “WPA2/WPA3-Personal” or "WPA3-Personal" is selected. If the Wi-Fi hotspot security is not set to “WPA2/WPA3-Personal” or "WPA3-Personal", this is a finding.

Fix Text (F-71274r1033114_fix)

This is a User-Based Enforcement (UBE) control. Train users to not change the default Wi-Fi hotspot security setting: 15-character complex Wi-Fi hotspot preshared key (password) ("WPA2/WPA3-Personal" or WPA3-Personal"). (GOOG-15-009800). If the required preshared key is not set up, train users to use the following procedure to set up the required setting: 1. Go to Settings >> Network & Internet >> Hotspot & tethering. 2. Enable "Wi-Fi hotspot". 3. Tap on the words to the left of the slide called "Wi-Fi Hotspot" to show the configuration options. 4. Click the "Security" link and select “WPA2/WPA3-Personal” or "WPA3-Personal".