CVE-2024-13917

Description

An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.pri.applock.LockUI“ activity allows any other malicious application, with no granted Android system permissions, to inject an arbitrary intent with system-level privileges to a protected application. One must know the protecting PIN number (it might be revealed by exploiting CVE-2024-13916) or ask the user to provide it. Vendor did not provide information about vulnerable versions. Only version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability

Reserved 2025-03-04 | Published 2025-05-30 | Updated 2025-05-30 | Assigner CERT-PL

Problem types

CWE-926 Improper Export of Android Application Components

Product status

Default status
unaffected

13
affected

Credits

Szymon Chadam finder

References

cert.pl/en/posts/2025/05/CVE-2024-13915 third-party-advisory

cve.org (CVE-2024-13917)

nvd.nist.gov (CVE-2024-13917)

Download JSON