CVE-2024-13915
Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device. Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger&Matz).
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.19%
- CWE
- CWE-926
- Published
- 2025-05-30
- Last modified
- 2026-03-13
Affected products
- Ulefone com.pri.factorytest
- Krüger&Matz com.pri.factorytest
Weakness type
Related vulnerabilities
- CVE-2026-20516 — In MiracastService, there is a possible escalation of privilege due to a confused deputy. This...
- CVE-2026-44965 — Six Android App Widget configuration activities in the Datadog Android application are declared...
- CVE-2026-47363 — The launcher activity AppActivity in the Datadog Android application is declared...
- CVE-2026-47361 — BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no...
- CVE-2026-18604 — textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components
- CVE-2026-20470 — In Telephony, there is a possible information disclosure due to a missing permission check. This...
- CVE-2026-57848 — Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation
- CVE-2026-12960 — An Improper Export of Android Application Components vulnerability in ASUS Router App allows a...