Vulnerabilities in Ulefone and Krüger & Matz Smartphones
On May 30, 2025, CERT Polska disclosed vulnerabilities found in pre-installed applications on smartphones manufactured by Ulefone and Krüger & Matz. The vulnerabilities are outlined under three distinct Common Vulnerabilities and Exposures (CVE) identifiers.
CVE-2024-13915
Affected Product: com.pri.factorytest
Vendor: Ulefone and Krüger & Matz
Vulnerable Version: All of version 1.0
Type of Vulnerability: Incorrect export of Android application components (CWE-926)
Source of Report: CERT Polska
The vulnerability in com.pri.factorytest is tied to a factory test application preloaded on devices during manufacturing. The application exposes a service (com.Pri.FactoryTest.Emmc.FactoryResService) that allows any app to perform a factory reset on the device without proper authorization. The update did not increment the version of the APK, leaving other builds released after December 2024 (Ulefone) and potentially in March 2025 (Krüger & Matz) vulnerable as well, though the latter’s timeline was not confirmed.
CVE-2024-13916
Affected Product: com.pri.applock
Vendor: Krüger & Matz
Vulnerable Version: 13
Type of Vulnerability: Exposure of sensitive system information to an unauthorized control sphere (CWE-497)
Source of Report: CERT Polska
The com.pri.applock application pre-installed on Krüger & Matz smartphones allows users to encrypt any application using a user-defined PIN or biometric data. However, it exposes a public method in the content provider (com.android.providers.settings.fingerprint.prifpshareprovider), which lets malicious applications exfiltrate the user’s PIN without requiring any granted system permissions. The only version examined (version 13, code version 33) is confirmed to possess this vulnerability.
CVE-2024-13917
Affected Product: com.pri.applock
Vendor: Krüger & Matz
Vulnerable Version: 13
Type of Vulnerability: Incorrect export of Android application components (CWE-926)
Source of Report: CERT Polska
Similar to CVE-2024-13916, this vulnerability in the com.pri.applock application allows malicious apps to inject arbitrary intents with system-level privileges into a protected application. To exploit this, the attacker would need to know the user’s PIN (which may be obtained via CVE-2024-13916) or prompt the user for it. Again, the tested version (version 13, code version 33) confirmed the presence of this vulnerability.
Summary
CERT Polska’s findings underscore critical vulnerabilities in the applications bundled with Ulefone and Krüger & Matz smartphones that could compromise user security. The first vulnerability (CVE-2024-13915) enables potential unauthorized factory resets of devices, while the latter two (CVE-2024-13916 and CVE-2024-13917) allow for exploitation of sensitive data (like PINs) and system-level access to apps.
These vulnerabilities highlight the importance of prompt software updates and security assessments in mobile application development and distribution. It is critical for users of affected devices to remain vigilant and ensure their apps are kept up-to-date to mitigate these risks.
Acknowledgment
Thanks to Szymon Chadam for the responsible vulnerability report. More information on the coordinated vulnerability disclosure process can be found at CERT Polska’s website: CERT Polska.