CVE-2025-50862
BaseFortify
Publication date: 2025-08-14
Last updated on: 2025-08-18
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lotus | cars_android_app | 1.2.8 |
| hcl | domino | 14.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Lotus Cars Android app version 1.2.8, where the app's manifest has the setting allowBackup=true. This setting allows an attacker with access to a rooted or debug-enabled device to extract app data using ADB backup, potentially exposing user data.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access and exfiltration of user data from the Lotus Cars app if the device is rooted or has debugging enabled, potentially compromising user privacy and security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the Lotus Cars Android app (com.lotus.carsdomestic.intl) version 1.2.8 has the allowBackup attribute set to true in its manifest. On a device, you can use the command 'adb shell dumpsys package com.lotus.carsdomestic.intl | grep allowBackup' to verify this setting. Additionally, checking for debug-enabled or rooted devices can help identify risk exposure.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling the allowBackup attribute in the app's manifest (setting allowBackup=false) and ensuring devices are not rooted or debug-enabled. If you are the app developer, release an updated version of the app with allowBackup set to false. For users, avoid using the app on rooted or debug-enabled devices to prevent data exfiltration via ADB backup.