CVE-2024-13915

30.05.2025, 16:15

Android based smartphones from vendors such as Ulefone andKrger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process.
The application"com.pri.factorytest"(version name: 1.0, version code: 1)exposes a com.pri.factorytest.emmc.FactoryResetService service allowing any application to perform a factory reset of the device.
Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krger&Matz).

Provider	Type	Base Score	Vector
NIST	NIST	UNKNOWN	---
CERT-PL	CNA	---	---
CISA-ADP	ADP	---	---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 3%

Common Weakness Enumeration

CWE-926 - Improper Export of Android Application Components
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

References

https://cert.pl/en/posts/2025/05/CVE-2024-13915