CVE-2024-13915

Description

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device.  Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and most probably March 2025 (Krüger&Matz, although the vendor has not confirmed it, so newer releases might be vulnerable as well).

Reserved 2025-03-04 | Published 2025-05-30 | Updated 2025-05-30 | Assigner CERT-PL

Problem types

CWE-926 Improper Export of Android Application Components

Product status

Default status
unaffected

Any version
unknown

Default status
unaffected

Any version
unknown

Credits

Szymon Chadam finder

References

cert.pl/en/posts/2025/05/CVE-2024-13915 third-party-advisory

cve.org (CVE-2024-13915)

nvd.nist.gov (CVE-2024-13915)

Download JSON