CVE-2025-9673mediumCWE-926

CVE-2025-9673: medium-severity vulnerability in Kakao 헤이카카오 Hey Kakao App

Kakao 헤이카카오 Hey Kakao App com.kakao.i.connect AndroidManifest.xml improper export of android application components

Published 29 Aug 2025

Follow this CVE + Monitor 헤이카카오 Hey Kakao App

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.1%

A vulnerability was detected in Kakao 헤이카카오 Hey Kakao App up to 2.17.4 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.kakao.i.connect. The manipulation results in improper export of android application components. The attack requires a local approach. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

Kakao · 헤이카카오 Hey Kakao App

References

https://github.com/KMov-g/androidapps/blob/main/com.kakao.i.connect.md https://github.com/KMov-g/androidapps/blob/main/com.kakao.i.connect.md#steps-to-reproduce https://vuldb.com/?ctiid.321883 https://vuldb.com/?id.321883 https://vuldb.com/?submit.637925