Android-based smartphones from vendors such as Ulefone and Krüger&Matz contain the ‘com.pri.factorytest’ application preloaded during the manufacturing process. This application exposes a service that allows any application to perform a factory reset of the device. The application update did not increment the APK version, leading to potential vulnerabilities in devices released after December 2024 and April 2025.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.9 | CVE-2024-13915 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious application that invokes the ‘com.pri.factorytest.emmc.FactoryResetService’ service, allowing it to perform a factory reset on the device without user consent. This can lead to data loss and unauthorized access to the device’s functionalities.
Affected Products
- Ulefone Smartphones: Devices manufactured after December 2024 may contain the vulnerable application.
- Krüger&Matz Smartphones: Devices released after April 2025 are likely to be affected, although confirmation from the manufacturer is pending.
Mitigation
To mitigate this vulnerability, users should avoid installing untrusted applications and ensure their devices are updated with the latest security patches from the manufacturers. Additionally, manufacturers should consider removing or securing the vulnerable service in future updates.