CVE-2024-13915CWE-926

Unrestricted Access to Exported Service in com.pri.factorytest

Medium · published May 30, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process.

The application "com.pri.factorytest" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device.

Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger&Matz).

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00192 · 8.4th percentile
Weakness
CWE-926 · Improper Export of Android Application Components
Published
2025-05-30T15:09Z
EPSS history
Timeline
  • 30 MAY 15:09Z
    Unrestricted Access to Exported Service in com.pri.factorytest
    cvelistv5