Three security vulnerabilities have been disclosed in preloaded Android purposes on smartphones from Ulefone and Krüger&Matz that might allow any app put in on the machine to carry out a manufacturing unit reset and encrypt an software.
A quick description of the three flaws is as follows –
- CVE-2024-13915 (CVSS rating: 6.9) – A pre-installed “com.pri.factorytest” software on Ulefone and Krüger&Matz smartphones exposes a “com.pri.factorytest.emmc.FactoryResetService” service that permits any put in software to carry out a manufacturing unit reset of the machine.
- CVE-2024-13916 (CVSS rating: 6.9) – A pre-installed “com.pri.applock” software on Kruger&Matz smartphones permits a person to encrypt any software utilizing user-provided PIN code or by utilizing biometric information. The app additionally exposes a “com.android.suppliers.settings.fingerprint.PriFpShareProvider” content material supplier’s “question()” methodology that allows any malicious app already put in on the machine by another means to exfiltrate the PIN code.
- CVE-2024-13917 (CVSS rating: 8.3) – A pre-installed “com.pri.applock” software on Kruger&Matz smartphones uncovered an “com.pri.applock.LockUI” exercise that permits every other malicious software, with no granted Android system permissions, to inject an arbitrary intent with system-level privileges to a protected software.
Whereas exploiting CVE-2024-13917 requires an adversary to know the protective PIN quantity, it might be chained with CVE-2024-13916 to leak the PIN code.
CERT Polska, which detailed the vulnerabilities, credited Szymon Chadam for responsibly disclosing them. Nevertheless, the precise patch standing of those flaws stay unclear. The Hacker Information has reached out to each Ulefone and Krüger&Matz for added remark and we’ll replace the story if we hear again.
