CVE-2024-13915 (GCVE-0-2024-13915)

Vulnerability from cvelistv5 – Published: 2025-05-30 15:09 – Updated: 2025-06-10 08:49
VLAI?
Title
Unrestricted Access to Exported Service in com.pri.factorytest
Summary
Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device.  Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger&Matz).
Severity ?
6.9 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-926 - Improper Export of Android Application Components
Assigner
References
Impacted products
Vendor Product Version
Ulefone com.pri.factorytest Unknown: 0 , ≤ 1.0 (semver)
Create a notification for this product.
Credits
Szymon Chadam
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13915",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-30T16:00:23.806310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-30T16:02:14.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "com.pri.factorytest",
          "vendor": "Ulefone",
          "versions": [
            {
              "lessThanOrEqual": "1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "com.pri.factorytest",
          "vendor": "Kr\u00fcger\u0026Matz",
          "versions": [
            {
              "lessThanOrEqual": "1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Szymon Chadam"
        }
      ],
      "datePublic": "2025-05-30T15:09:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Android based smartphones from vendors such as Ulefone and\u0026nbsp;Kr\u00fcger\u0026amp;Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\u003cbr\u003eThe application\u0026nbsp;\"com.pri.factorytest\"\u0026nbsp;(version name: 1.0, version code: 1)\u0026nbsp;exposes a \u201dcom.pri.factorytest.emmc.FactoryResetService\u201c service allowing any application to perform a factory reset of the device.\u0026nbsp;\u003cbr\u003eApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\u00fcger\u0026amp;Matz).\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Android based smartphones from vendors such as Ulefone and\u00a0Kr\u00fcger\u0026Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\nThe application\u00a0\"com.pri.factorytest\"\u00a0(version name: 1.0, version code: 1)\u00a0exposes a \u201dcom.pri.factorytest.emmc.FactoryResetService\u201c service allowing any application to perform a factory reset of the device.\u00a0\nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\u00fcger\u0026Matz)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-926",
              "description": "CWE-926 Improper Export of Android Application Components",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-10T08:49:37.732Z",
        "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "shortName": "CERT-PL"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://cert.pl/en/posts/2025/05/CVE-2024-13915"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unrestricted Access to Exported Service in com.pri.factorytest",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
    "assignerShortName": "CERT-PL",
    "cveId": "CVE-2024-13915",
    "datePublished": "2025-05-30T15:09:58.520Z",
    "dateReserved": "2025-03-04T13:18:34.018Z",
    "dateUpdated": "2025-06-10T08:49:37.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-13915\",\"sourceIdentifier\":\"cvd@cert.pl\",\"published\":\"2025-05-30T16:15:35.953\",\"lastModified\":\"2025-06-10T09:15:22.463\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Android based smartphones from vendors such as Ulefone and\u00a0Kr\u00fcger\u0026Matz contain \\\"com.pri.factorytest\\\" application preloaded onto devices during manufacturing process.\\nThe application\u00a0\\\"com.pri.factorytest\\\"\u00a0(version name: 1.0, version code: 1)\u00a0exposes a \u201dcom.pri.factorytest.emmc.FactoryResetService\u201c service allowing any application to perform a factory reset of the device.\u00a0\\nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\u00fcger\u0026Matz).\"},{\"lang\":\"es\",\"value\":\"Los smartphones Android de fabricantes como Ulefone and Kr\u00fcger\u0026amp;Matz contienen la aplicaci\u00f3n \\\"com.pri.factorytest\\\" preinstalada durante el proceso de fabricaci\u00f3n. Esta aplicaci\u00f3n (nombre de la versi\u00f3n: 1.0, c\u00f3digo de la versi\u00f3n: 1) expone el servicio \\\"com.pri.factorytest.emmc.FactoryResetService\\\" que permite a cualquier aplicaci\u00f3n restablecer el dispositivo a la configuraci\u00f3n de f\u00e1brica. La actualizaci\u00f3n de la aplicaci\u00f3n no increment\u00f3 la versi\u00f3n del APK. En cambio, se incluy\u00f3 en compilaciones del sistema operativo publicadas despu\u00e9s de diciembre de 2024 (Ulefone) y, muy probablemente, en marzo de 2025 (Kr\u00fcger\u0026amp;Matz, aunque el fabricante no lo ha confirmado, por lo que las versiones m\u00e1s recientes tambi\u00e9n podr\u00edan ser vulnerables).\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cvd@cert.pl\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"cvd@cert.pl\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-926\"}]}],\"references\":[{\"url\":\"https://cert.pl/en/posts/2025/05/CVE-2024-13915\",\"source\":\"cvd@cert.pl\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-13915\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-30T16:00:23.806310Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-30T16:02:07.799Z\"}}], \"cna\": {\"title\": \"Unrestricted Access to Exported Service in com.pri.factorytest\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Szymon Chadam\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 6.9, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Ulefone\", \"product\": \"com.pri.factorytest\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.0\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Kr\\u00fcger\u0026Matz\", \"product\": \"com.pri.factorytest\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.0\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-05-30T15:09:00.000Z\", \"references\": [{\"url\": \"https://cert.pl/en/posts/2025/05/CVE-2024-13915\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Android based smartphones from vendors such as Ulefone and\\u00a0Kr\\u00fcger\u0026Matz contain \\\"com.pri.factorytest\\\" application preloaded onto devices during manufacturing process.\\nThe application\\u00a0\\\"com.pri.factorytest\\\"\\u00a0(version name: 1.0, version code: 1)\\u00a0exposes a \\u201dcom.pri.factorytest.emmc.FactoryResetService\\u201c service allowing any application to perform a factory reset of the device.\\u00a0\\nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\\u00fcger\u0026Matz).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Android based smartphones from vendors such as Ulefone and\u0026nbsp;Kr\\u00fcger\u0026amp;Matz contain \\\"com.pri.factorytest\\\" application preloaded onto devices during manufacturing process.\u003cbr\u003eThe application\u0026nbsp;\\\"com.pri.factorytest\\\"\u0026nbsp;(version name: 1.0, version code: 1)\u0026nbsp;exposes a \\u201dcom.pri.factorytest.emmc.FactoryResetService\\u201c service allowing any application to perform a factory reset of the device.\u0026nbsp;\u003cbr\u003eApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\\u00fcger\u0026amp;Matz).\u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-926\", \"description\": \"CWE-926 Improper Export of Android Application Components\"}]}], \"providerMetadata\": {\"orgId\": \"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6\", \"shortName\": \"CERT-PL\", \"dateUpdated\": \"2025-06-10T08:49:37.732Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-13915\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-10T08:49:37.732Z\", \"dateReserved\": \"2025-03-04T13:18:34.018Z\", \"assignerOrgId\": \"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6\", \"datePublished\": \"2025-05-30T15:09:58.520Z\", \"assignerShortName\": \"CERT-PL\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.