{"id":"CVE-2024-13915","aliases":["EUVD-2025-16514","GHSA-9m9c-m3m8-59vc"],"status":"published","title":"Unrestricted Access to Exported Service in com.pri.factorytest","description":"Android based smartphones from vendors such as Ulefone and Krüger\u0026Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\nThe application \"com.pri.factorytest\" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device. \nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger\u0026Matz).","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00201,"percentile":0.10067,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-926"],"published":"2025-05-30T15:09:58Z","modified":"2026-06-17T07:02:58Z","products":[{"vendor":"kruger\u0026matz","product":"com.pri.factorytest"},{"vendor":"krüger\u0026matz","product":"com.pri.factorytest"},{"vendor":"ulefone","product":"com.pri.factorytest"}],"references":[{"url":"https://cert.pl/en/posts/2025/05/CVE-2024-13915","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13915"},{"url":"https://github.com/advisories/GHSA-9m9c-m3m8-59vc"}],"sources":{"cve":[{"id":"CVE-2024-13915","title":"Unrestricted Access to Exported Service in com.pri.factorytest","description":"Android based smartphones from vendors such as Ulefone and Krüger\u0026Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\nThe application \"com.pri.factorytest\" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device. \nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger\u0026Matz).","status":"published","published":"2025-05-30T15:09:58.52Z","modified":"2025-06-10T08:49:37.732Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-926"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2025-16514","description":"Android based smartphones from vendors such as Ulefone and Krüger\u0026Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\nThe application \"com.pri.factorytest\" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device. \nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger\u0026Matz).","status":"published","published":"2025-05-30T15:09:58Z","modified":"2025-06-10T08:49:37Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:32:27.346488Z"}],"ghsa":[{"id":"GHSA-9m9c-m3m8-59vc","title":"Android based smartphones from vendors such as Ulefone and Krüger\u0026Matz contain \"com.pri...","description":"Android based smartphones from vendors such as Ulefone and Krüger\u0026Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\nThe application \"com.pri.factorytest\" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device. \nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and most probably March 2025 (Krüger\u0026Matz, although the vendor has not confirmed it, so newer releases might be vulnerable as well).","status":"published","published":"2025-05-30T18:31:13Z","modified":"2025-05-30T18:31:14Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-926"],"updated_at":"2026-11-02T15:02:31.34634Z"}],"nvd":[{"id":"CVE-2024-13915","description":"Android based smartphones from vendors such as Ulefone and Krüger\u0026Matz contain \"com.pri.factorytest\" application preloaded onto devices during manufacturing process.\nThe application \"com.pri.factorytest\" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device. \nApplication update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger\u0026Matz).","status":"published","published":"2025-05-30T16:15:35.953Z","modified":"2026-06-17T07:02:58.99Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-926"],"updated_at":"2026-11-02T14:10:47.073504Z"}]}}