CVE-2025-15464
BaseFortify
Publication date: 2026-01-08
Last updated on: 2026-02-12
Assigner: KoreLogic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yintibao | fun_print | 6.05.15 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-926 | The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15464 is a vulnerability in the yintibao Fun Print Mobile app (version 6.05.15) on ARM64 Android devices. The app's PandoraEntryActivity is exported and accepts external intents without proper validation. This allows any external application to interact with it, gain the app's context, and directly launch Gmail with inbox access, bypassing security controls. The vulnerability arises because the activity processes incoming intents without validating them, enabling context hijacking and unauthorized access to the user's email account if the device's email is attached to the app. [1]
How can this vulnerability impact me? :
This vulnerability can allow a malicious external application to gain unauthorized access to your Gmail inbox by hijacking the application context of the vulnerable app. This means attackers could potentially read your emails or perform actions within your inbox without your consent, bypassing normal security controls. The attack requires the malicious app to have the device's email account attached to the vulnerable app, making it a significant privacy and security risk. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the PandoraEntryActivity in the yintibao Fun Print Mobile app (version 6.05.15) is exported and accepts external intents without validation. On a rooted Android device, tools like 'adb' can be used to inspect the app's manifest for android:exported="true" on PandoraEntryActivity. Additionally, dynamic analysis using Frida on a rooted device can help detect if external intents with the extra START_FROM_TO_CLASS are processed without validation. For example, using 'adb shell dumpsys package yintibao.fun_print_mobile' to inspect exported components, or employing Frida scripts to monitor intent handling in PandoraEntryActivity. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the installation or use of the vulnerable yintibao Fun Print Mobile app version 6.05.15 on devices, especially those running Android 13 on ARM64. Since no vendor patches or mitigations are available, consider removing or disabling the app on critical devices. Additionally, avoid running the app on rooted devices or environments where malicious applications can send crafted intents. Monitoring and restricting external applications from sending intents to PandoraEntryActivity can also help reduce risk. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.