com.sec.android.app.wlantest Copy

Labelled "WlanTest", this is the Wi-Fi side of the same Samsung factory test tooling: a Samsung-signed system package with no launcher entry, recorded as not user-facing on every observation here. It declares android.permission.FACTORY_TEST, which the Android platform manifest defines as running as a manufacturer test application with root user privilege and notes is only available when the device is running in manufacturer test mode, together with Samsung's own WIFI_FACTORY_TEST, WIFI_DIAGNOSTICS_PROVIDER, WIFI_READ_MAC_ADDRESS and SEM_ACCESS_WIFI_SECURED_INFO permissions and the platform's READ_WIFI_CREDENTIAL and MANAGE_WIFI_COUNTRY_CODE. Two published vulnerabilities corroborate that Wi-Fi role and are the reason a managed fleet should care about it. CVE-2024-20834 describes a sensitive information exposure in WlanTest prior to Samsung's SMR Mar-2024 Release 1 that allowed local attackers to access the MAC address without proper permission, and CVE-2024-34680 describes use of an implicit intent for sensitive communication prior to SMR Nov-2024 Release 1 that allowed local attackers to obtain sensitive information. Both were addressed by Samsung maintenance releases, which makes patch currency the effective control rather than removal of the package. Version note, and it is a caution about reading version strings. Samsung's application lists record WlanTest at 1.1.0 on Android 9-era Galaxy S10+ firmware and again at 1.1.0 on Android 11-era Galaxy S20 FE and S20 Ultra firmware, and this site records 1.1.0 as both the oldest and the newest build observed. The version string has therefore not moved even though the two fixes above show the code did change, so it is uninformative for judging whether a device is patched; the target SDK does move, from 30 to 37 across observations here, and the package is seen from API 28 through API 37. No change of role across Android releases could be sourced. For Android Enterprise, EMM and kiosk use, the interest is its reach into Wi-Fi credentials, the device MAC address and the regulatory country code on a device that may be shared or unattended. Judge it by the device's security patch level first, and treat inventory hygiene and kiosk allowlisting as the secondary controls. Samsung does not document what depends on the package, so disabling is rated caution.

• core/res/AndroidManifest.xml (android.permission.FACTORY_TEST) - Android platform source →
• CVE-2024-20834 (sensitive information exposure in WlanTest) - CVE Program record →
• CVE-2024-34680 (implicit intent for sensitive communication in WlanTest) - CVE Program record →
• Galaxy S10+ LTE (G975F) application list - Samsung Knox CC Mode documentation →
• Galaxy S20 FE 5G (G781B) application list - Samsung Knox CC Mode documentation →
• Galaxy S20 Ultra 5G (G988W) application list - Samsung Knox CC Mode documentation →
• Package provenance for com.sec.android.app.wlantest - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 19 permissions: 6 runtime (user-granted), 5 signature or system-level, 3 install-time and 5 vendor or uncatalogued.
• Reported as an updated system app on 1 of 21 profiles - a newer build is installed over the one in the system image there.