CVE-2025-9135

A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1(258) on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper export of android application components. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 12.1.2(259) is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor was contacted early and fixed the issue by "[r]emoving the task affinity of the app so it can't be copied".

Scoring

Severity

MEDIUM

CVSS base score

5.3

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

EPSS probability

0.29%

CWE

CWE-926

Published

2025-08-19

Last modified

2026-03-12

Affected products

• Verkehrsauskunft Österreich SmartRide
• Verkehrsauskunft Österreich SmartRide
• Verkehrsauskunft Österreich cleVVVer
• Verkehrsauskunft Österreich cleVVVer
• Verkehrsauskunft Österreich BusBahnBim
• Verkehrsauskunft Österreich BusBahnBim
• Verkehrsauskunft Österreich Salzburg Verkehr
• Verkehrsauskunft Österreich Salzburg Verkehr

Weakness type

• CWE-926

Related vulnerabilities

• CVE-2026-20516 — In MiracastService, there is a possible escalation of privilege due to a confused deputy. This...
• CVE-2026-44965 — Six Android App Widget configuration activities in the Datadog Android application are declared...
• CVE-2026-47363 — The launcher activity AppActivity in the Datadog Android application is declared...
• CVE-2026-47361 — BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no...
• CVE-2026-18604 — textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components
• CVE-2026-20470 — In Telephony, there is a possible information disclosure due to a missing permission check. This...
• CVE-2026-57848 — Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation
• CVE-2026-12960 — An Improper Export of Android Application Components vulnerability in ASUS Router App allows a...

Markdown version · Browse all CVEs