CVE-2025-8524

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-8524", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-08-04T06:37:00.383Z", "datePublished": "2025-08-04T20:02:05.674Z", "dateUpdated": "2025-08-04T20:17:54.897Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-08-04T20:02:05.674Z"}, "title": "Boquan DotWallet App com.boquanhash.dotwallet AndroidManifest.xml improper export of android application components", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-926", "lang": "en", "description": "Improper Export of Android Application Components"}]}], "affected": [{"vendor": "Boquan", "product": "DotWallet App", "versions": [{"version": "2.15.2", "status": "affected"}], "modules": ["com.boquanhash.dotwallet"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Boquan DotWallet App 2.15.2 on Android and classified as problematic. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.boquanhash.dotwallet. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Eine Schwachstelle wurde in Boquan DotWallet App 2.15.2 f\u00fcr Android gefunden. Sie wurde als problematisch eingestuft. Davon betroffen ist unbekannter Code der Datei AndroidManifest.xml der Komponente com.boquanhash.dotwallet. Mit der Manipulation mit unbekannten Daten kann eine improper export of android application components-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2025-08-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-08-04T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-08-04T08:42:04.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fxizenta (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.318650", "name": "VDB-318650 | Boquan DotWallet App com.boquanhash.dotwallet AndroidManifest.xml improper export of android application components", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.318650", "name": "VDB-318650 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.619037", "name": "Submit #619037 | Boquan DotWallet(com.boquanhash.dotwallet) 2.15.2 Task Hijacking", "tags": ["third-party-advisory"]}, {"url": "https://github.com/KMov-g/androidapps/blob/main/com.boquanhash.dotwallet.md", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-04T20:15:34.549608Z", "id": "CVE-2025-8524", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T20:17:54.897Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8524", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-04T20:15:34.549608Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T20:17:39.190Z"}}], "cna": {"title": "Boquan DotWallet App com.boquanhash.dotwallet AndroidManifest.xml improper export of android application components", "credits": [{"lang": "en", "type": "reporter", "value": "fxizenta (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Boquan", "modules": ["com.boquanhash.dotwallet"], "product": "DotWallet App", "versions": [{"status": "affected", "version": "2.15.2"}]}], "timeline": [{"lang": "en", "time": "2025-08-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-08-04T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-08-04T08:42:04.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.318650", "name": "VDB-318650 | Boquan DotWallet App com.boquanhash.dotwallet AndroidManifest.xml improper export of android application components", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.318650", "name": "VDB-318650 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.619037", "name": "Submit #619037 | Boquan DotWallet(com.boquanhash.dotwallet) 2.15.2 Task Hijacking", "tags": ["third-party-advisory"]}, {"url": "https://github.com/KMov-g/androidapps/blob/main/com.boquanhash.dotwallet.md", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Boquan DotWallet App 2.15.2 on Android and classified as problematic. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.boquanhash.dotwallet. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Eine Schwachstelle wurde in Boquan DotWallet App 2.15.2 f\u00fcr Android gefunden. Sie wurde als problematisch eingestuft. Davon betroffen ist unbekannter Code der Datei AndroidManifest.xml der Komponente com.boquanhash.dotwallet. Mit der Manipulation mit unbekannten Daten kann eine improper export of android application components-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-926", "description": "Improper Export of Android Application Components"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-08-04T20:02:05.674Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8524", "state": "PUBLISHED", "dateUpdated": "2025-08-04T20:17:54.897Z", "dateReserved": "2025-08-04T06:37:00.383Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-08-04T20:02:05.674Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["com.boquanhash.dotwallet"], "product": "DotWallet App", "vendor": "Boquan", "versions": [{"status": "affected", "version": "2.15.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Boquan DotWallet App 2.15.2 on Android and classified as problematic. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.boquanhash.dotwallet. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en la aplicaci\u00f3n Boquan DotWallet 2.15.2 para Android, clasificada como problem\u00e1tica. Este problema afecta a una funcionalidad desconocida del archivo AndroidManifest.xml del componente com.boquanhash.dotwallet. Esta manipulaci\u00f3n provoca la exportaci\u00f3n incorrecta de componentes de la aplicaci\u00f3n Android. El ataque debe abordarse localmente. Se ha hecho p\u00fablico el exploit y puede que sea utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n para informarle sobre esta divulgaci\u00f3n, pero no respondi\u00f3."}], "id": "CVE-2025-8524", "lastModified": "2026-06-17T10:07:09.090", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8524", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-04T20:15:34.549608Z", "version": "2.0.3"}}]}, "published": "2025-08-04T20:15:32.163", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/KMov-g/androidapps/blob/main/com.boquanhash.dotwallet.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.318650"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.318650"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.619037"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-926"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-08-05T11:38:54.649722+00:00", "updated": "2025-08-05T11:38:54.649784+00:00", "vendors": ["boquan", "boquan$PRODUCT$dotwalle_app", "google", "google$PRODUCT$android"]}