CVE-2024-13916

Description

An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code. Vendor did not provide information about vulnerable versions. Only version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability

Reserved 2025-03-04 | Published 2025-05-30 | Updated 2025-05-30 | Assigner CERT-PL

Problem types

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Product status

Default status
unknown

13
affected

Credits

Szymon Chadam finder

References

cert.pl/en/posts/2025/05/CVE-2024-13915 third-party-advisory

cve.org (CVE-2024-13916)

nvd.nist.gov (CVE-2024-13916)

Download JSON