CVE-2025-5346CWE-926

File removal via path traversal in unsecured broadcast receiver in Bluebird barcode scanner application

Medium · published July 17, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver "kr.co.bluebird.android.bbsettings.BootReceiver". A local attacker can call the receiver to overwrite file containing ".json" keyword with default barcode config file. It is possible to overwrite file in any location due to lack of protection against path traversal in name of the file.

This issue affects all versions before 1.3.3.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-926 · Improper Export of Android Application Components
Published
2025-07-17T12:45Z
EPSS history
Timeline
  • 17 JUL 12:45Z
    File removal via path traversal in unsecured broadcast receiver in Bluebird barcode scanner application
    cvelistv5