Vulnerability · Published May 30, 2025 · Assigned by CERT-PL

CVE-2024-13915Unrestricted Access to Exported Service in com.pri.factorytest

Medium 6.9

In plain English

A medium-severity security flaw in com.pri.factorytest from Krüger&Matz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.2%top 90.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device. Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger&Matz).

Affected products (as reported)

Vendor	Product	Versions
Ulefone	com.pri.factorytest	see references
Krüger&Matz	com.pri.factorytest	see references

Weakness: CWE-926 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2025/05/CVE-2024-13915 third-party-advisory