CVE-2025-57197
BaseFortify
Publication date: 2025-09-29
Last updated on: 2025-09-30
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| payeer | payeer_android_app | 2.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-57197 is an authentication bypass vulnerability in the Payeer Android app version 2.5.0 affecting the Change PIN feature. The app performs PIN verification entirely on the client side without server validation. A local attacker with root access can use dynamic instrumentation tools like Frida to hook the PIN verification method and force it to always succeed, allowing them to change the PIN without knowing the original one. [1]
How can this vulnerability impact me? :
This vulnerability allows unauthorized users with root access on the device to bypass PIN verification and change the authentication PIN without knowing the original. This can lead to unauthorized access to the app, potential financial loss, or locking out legitimate users from their accounts. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the PIN verification method in the Payeer Android app version 2.5.0 can be bypassed using dynamic instrumentation tools like Frida on a rooted device. Specifically, hooking the method `y1.a()` that verifies the PIN to see if it can be forced to always return a valid result regardless of input. Commands involve using Frida to attach to the app and hook the PIN verification method, for example: `frida -n com.payeer -p <pid> -l hook_pin.js` where `hook_pin.js` contains the script to override the `y1.a()` method. This confirms the vulnerability by allowing PIN change without the original PIN. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Avoid running the Payeer app on rooted devices to reduce risk of exploitation. 2) Implement server-side validation of the current PIN before allowing any PIN changes to prevent client-side bypass. 3) Add runtime protections such as root/jailbreak detection and integrity checks to prevent dynamic instrumentation. 4) Obfuscate sensitive client-side methods and consider moving critical authentication logic to native code to hinder hooking attempts. [1]