Read the docs
TI-2024-12934 Aliases CVE-2024-13915GHSA-9m9c-m3m8-59vc

Unrestricted Access to Exported Service in com.pri.factorytest

Priority LOW 30CWE-926Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device.  Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger&Matz).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00201 10th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ulefonecom.pri.factorytest——Not affectedCNA
Krüger&Matzcom.pri.factorytest——Not affectedCNA
  • com.pri.factorytest VendorUlefone Affected — Fixed in — Not affected CNA
  • com.pri.factorytest VendorKrüger&Matz Affected — Fixed in — Not affected CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-13915
  2. 2026-10-03 Alias added: GHSA-9m9c-m3m8-59vc

References

Advisory 1

  • TI-2019-11458 The Ulefone Armor 5 Android device with a build fingerprint of… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences