{"id":"CVE-2024-13916","aliases":["EUVD-2024-54615","GHSA-pw53-33fx-vf55"],"status":"published","title":"Exposure of Applications' Encryption PINs in Kruger\u0026Matz AppLock","description":"An application \"com.pri.applock\", which is pre-loaded on Kruger\u0026Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data.\nExposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code.\n\nOnly version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability. \nApplication update was released in April 2025.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00189,"percentile":0.08616,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-497","CWE-926"],"published":"2025-05-30T15:16:03Z","modified":"2026-06-17T07:02:59Z","products":[{"vendor":"kruger\u0026matz","product":"com.pri.applock"}],"references":[{"url":"https://cert.pl/en/posts/2025/05/CVE-2024-13915","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13916"},{"url":"https://github.com/advisories/GHSA-pw53-33fx-vf55"}],"sources":{"cve":[{"id":"CVE-2024-13916","title":"Exposure of Applications' Encryption PINs in Kruger\u0026Matz AppLock","description":"An application \"com.pri.applock\", which is pre-loaded on Kruger\u0026Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data.\nExposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code.\n\nOnly version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability. \nApplication update was released in April 2025.","status":"published","published":"2025-05-30T15:16:03.066Z","modified":"2025-10-03T09:01:35.255Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-926"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-54615","description":"An application \"com.pri.applock\", which is pre-loaded on Kruger\u0026Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data.\nExposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code.\n\nOnly version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability. \nApplication update was released in April 2025.","status":"published","published":"2025-05-30T15:16:03Z","modified":"2025-10-03T09:01:35Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:31:36.727084Z"}],"ghsa":[{"id":"GHSA-pw53-33fx-vf55","title":"An application \"com.pri.applock\", which is pre-loaded on Kruger\u0026Matz smartphones, allows a user...","description":"An application \"com.pri.applock\", which is pre-loaded on Kruger\u0026Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data.\nExposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code.\n\nVendor did not provide information about vulnerable versions.\nOnly version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability","status":"published","published":"2025-05-30T18:31:13Z","modified":"2025-10-03T09:31:21Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-497","CWE-926"],"updated_at":"2026-11-02T15:03:50.770325Z"}],"nvd":[{"id":"CVE-2024-13916","description":"An application \"com.pri.applock\", which is pre-loaded on Kruger\u0026Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data.\nExposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code.\n\nOnly version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability. \nApplication update was released in April 2025.","status":"published","published":"2025-05-30T16:15:36.117Z","modified":"2026-06-17T07:02:59.137Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-926"],"updated_at":"2026-11-02T14:10:47.073504Z"}]}}