CVE-2025-9135

Katalog CVE

CVSS 5.5 · Medium EPSS 0,26%

Kerentanan Improper Export of Android Application Components pada verkehrsauskunft smartride. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1(258) on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper export of android application components. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 12.1.2(259) is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor was contacted early and fixed the issue by "[r]emoving the task affinity of the app so it can't be copied".

Rincian

Terbit di NVD

19 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-926: Improper Export of Android Application Components

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md exploit · advisory pihak ketiga
• https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md#steps-to-reproduce exploit · advisory pihak ketiga
• https://vuldb.com/?id.320515 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.615276 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.615278 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.628235 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.320515 permissions required · vdb entry