CVE-2024-13916CWE-926

Exposure of Applications' Encryption PINs in Kruger&Matz AppLock

Medium · published May 30, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data.

Exposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code.

Only version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability.

Application update was released in April 2025.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-926 · Improper Export of Android Application Components
Published
2025-05-30T15:16Z
EPSS history
Timeline
  • 30 MAY 15:16Z
    Exposure of Applications' Encryption PINs in Kruger&Matz AppLock
    cvelistv5