CVE-2025-50861
BaseFortify
Publication date: 2025-08-14
Last updated on: 2025-08-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lotus_cars | android_app | 1.2.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Lotus Cars Android app version 1.2.8, where an exported component named PushDeepLinkActivity is accessible without authentication. This means that anyone using ADB or a malicious app can access this component, potentially leading to unintended access to the app's internal functions.
How can this vulnerability impact me? :
This vulnerability can lead to denial of service or logic abuse within the app, meaning attackers could disrupt the app's normal operation or manipulate its behavior in unintended ways.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the PushDeepLinkActivity component is exported and accessible without authentication. On an Android device, use the command: adb shell dumpsys package com.lotus.carsdomestic.intl | grep PushDeepLinkActivity to verify if the component is exported. Additionally, you can use adb shell pm list packages to confirm the app is installed. Monitoring for unexpected access to this component may also help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the PushDeepLinkActivity component by disabling its export in the app's manifest or applying authentication checks. If you cannot modify the app, avoid installing or remove the vulnerable version (1.2.8) of the Lotus Cars Android app. Additionally, limit ADB access on devices and prevent installation of malicious apps that could exploit this component.