Vulnerability · Published Jan 6, 2025 · Assigned by GitHub_M

CVE-2025-21615AAT allows data exfiltration by other apps installed on the same device

Medium 5.5

In plain English

A medium-severity information exposure in AAT from bailuk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 93.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.

Affected products (as reported)

Vendor	Product	Versions
bailuk	AAT	< 1.26

Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://github.com/bailuk/AAT/security/advisories/GHSA-pwpm-x58v-px5c x_refsource_CONFIRM