CVE-2025-5345mediumCWE-926

CVE-2025-5345: falha de média gravidade em Bluebird com.bluebird.filemanagers

Exposed AIDL service allowing to read and delete files with system-level privileges in Bluebird filemanager application

Publicada em

Seguir esta CVE+ Monitorar com.bluebird.filemanagers

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.1%
Bluebird devices contain a pre-loaded file manager application. This application exposes an unsecured service provider "com.bluebird.system.koreanpost.IsdcardRemoteService". A local attacker can bind to the AIDL-type service to copy and delete arbitrary files from device's storage with system-level permissions. Version 1.4.4 is vulnerable, vendor reverted vulnerable versions to older version: 1.3.6
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Produtos afetados
Bluebird · com.bluebird.filemanagers