CVE-2024-13916mediumCWE-926

CVE-2024-13916: medium-severity vulnerability in Kruger&Matz com.pri.applock

Exposure of Applications' Encryption PINs in Kruger&Matz AppLock

Published · Updated

Follow this CVE+ Monitor com.pri.applock

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.2%
An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code. Only version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability. Application update was released in April 2025.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Kruger&Matz · com.pri.applock
Related CVEs — Kruger&Matz com.pri.applock

In the same product, most dangerous first.

CVE-2024-13917HIGHIntent Injection in Kruger&Matz AppLock applicationEPSS 0.2%