Android-based smartphones from vendors such as Ulefone and Krüger&Matz contain the preloaded application ‘com.pri.factorytest’. This application exposes a service that allows any application to perform a factory reset of the device. The vulnerability arises because the application update did not increment the APK version, leading to potential exploitation in OS builds released after December 2024 for Ulefone and April 2025 for Krüger&Matz.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.9 | CVE-2024-13915 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious application that interacts with the ‘com.pri.factorytest.emmc.FactoryResetService’ service. By invoking this service, the attacker can perform a factory reset on the device without any user interaction or special privileges, effectively wiping the device’s data.
Affected Products
- Ulefone Smartphones: Devices manufactured after December 2024 may contain the vulnerable application.
- Krüger&Matz Smartphones: Devices likely manufactured after April 2025 may also be affected, though confirmation from the manufacturer is pending.
Mitigation
To mitigate this vulnerability, users should avoid installing untrusted applications and ensure their devices are updated with the latest security patches from the manufacturers. Additionally, manufacturers should consider removing or securing the vulnerable service in future updates.