CVE-2024-13915

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13915", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2025-03-04T13:18:34.018Z", "datePublished": "2025-05-30T15:09:58.520Z", "dateUpdated": "2025-06-10T08:49:37.732Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "com.pri.factorytest", "vendor": "Ulefone", "versions": [{"lessThanOrEqual": "1.0", "status": "unknown", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "com.pri.factorytest", "vendor": "Kr\u00fcger&Matz", "versions": [{"lessThanOrEqual": "1.0", "status": "unknown", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Szymon Chadam"}], "datePublic": "2025-05-30T15:09:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Android based smartphones from vendors such as Ulefone and&nbsp;Kr\u00fcger&amp;Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.<br>The application&nbsp;\"com.pri.factorytest\"&nbsp;(version name: 1.0, version code: 1)&nbsp;exposes a \u201dcom.pri.factorytest.emmc.FactoryResetService\u201c service allowing any application to perform a factory reset of the device.&nbsp;<br>Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\u00fcger&amp;Matz).<br><br>"}], "value": "Android based smartphones from vendors such as Ulefone and\u00a0Kr\u00fcger&Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\nThe application\u00a0\"com.pri.factorytest\"\u00a0(version name: 1.0, version code: 1)\u00a0exposes a \u201dcom.pri.factorytest.emmc.FactoryResetService\u201c service allowing any application to perform a factory reset of the device.\u00a0\nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\u00fcger&Matz)."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-926", "description": "CWE-926 Improper Export of Android Application Components", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2025-06-10T08:49:37.732Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2025/05/CVE-2024-13915"}], "source": {"discovery": "EXTERNAL"}, "title": "Unrestricted Access to Exported Service in com.pri.factorytest", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-30T16:00:23.806310Z", "id": "CVE-2024-13915", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T16:02:14.501Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-13915", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-30T16:00:23.806310Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T16:02:07.799Z"}}], "cna": {"title": "Unrestricted Access to Exported Service in com.pri.factorytest", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Szymon Chadam"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ulefone", "product": "com.pri.factorytest", "versions": [{"status": "unknown", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Kr\u00fcger&Matz", "product": "com.pri.factorytest", "versions": [{"status": "unknown", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "datePublic": "2025-05-30T15:09:00.000Z", "references": [{"url": "https://cert.pl/en/posts/2025/05/CVE-2024-13915", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Android based smartphones from vendors such as Ulefone and\u00a0Kr\u00fcger&Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\nThe application\u00a0\"com.pri.factorytest\"\u00a0(version name: 1.0, version code: 1)\u00a0exposes a \u201dcom.pri.factorytest.emmc.FactoryResetService\u201c service allowing any application to perform a factory reset of the device.\u00a0\nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\u00fcger&Matz).", "supportingMedia": [{"type": "text/html", "value": "Android based smartphones from vendors such as Ulefone and&nbsp;Kr\u00fcger&amp;Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.<br>The application&nbsp;\"com.pri.factorytest\"&nbsp;(version name: 1.0, version code: 1)&nbsp;exposes a \u201dcom.pri.factorytest.emmc.FactoryResetService\u201c service allowing any application to perform a factory reset of the device.&nbsp;<br>Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\u00fcger&amp;Matz).<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-926", "description": "CWE-926 Improper Export of Android Application Components"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2025-06-10T08:49:37.732Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13915", "state": "PUBLISHED", "dateUpdated": "2025-06-10T08:49:37.732Z", "dateReserved": "2025-03-04T13:18:34.018Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2025-05-30T15:09:58.520Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "com.pri.factorytest", "vendor": "Ulefone", "versions": [{"lessThanOrEqual": "1.0", "status": "unknown", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "com.pri.factorytest", "vendor": "Kr\u00fcger&Matz", "versions": [{"lessThanOrEqual": "1.0", "status": "unknown", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Android based smartphones from vendors such as Ulefone and\u00a0Kr\u00fcger&Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\nThe application\u00a0\"com.pri.factorytest\"\u00a0(version name: 1.0, version code: 1)\u00a0exposes a \u201dcom.pri.factorytest.emmc.FactoryResetService\u201c service allowing any application to perform a factory reset of the device.\u00a0\nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Kr\u00fcger&Matz)."}, {"lang": "es", "value": "Los smartphones Android de fabricantes como Ulefone and Kr\u00fcger&amp;Matz contienen la aplicaci\u00f3n \"com.pri.factorytest\" preinstalada durante el proceso de fabricaci\u00f3n. Esta aplicaci\u00f3n (nombre de la versi\u00f3n: 1.0, c\u00f3digo de la versi\u00f3n: 1) expone el servicio \"com.pri.factorytest.emmc.FactoryResetService\" que permite a cualquier aplicaci\u00f3n restablecer el dispositivo a la configuraci\u00f3n de f\u00e1brica. La actualizaci\u00f3n de la aplicaci\u00f3n no increment\u00f3 la versi\u00f3n del APK. En cambio, se incluy\u00f3 en compilaciones del sistema operativo publicadas despu\u00e9s de diciembre de 2024 (Ulefone) y, muy probablemente, en marzo de 2025 (Kr\u00fcger&amp;Matz, aunque el fabricante no lo ha confirmado, por lo que las versiones m\u00e1s recientes tambi\u00e9n podr\u00edan ser vulnerables)."}], "id": "CVE-2024-13915", "lastModified": "2026-06-17T07:02:58.990", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-13915", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-30T16:00:23.806310Z", "version": "2.0.3"}}]}, "published": "2025-05-30T16:15:35.953", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2025/05/CVE-2024-13915"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-926"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{}