An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data.
Exposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code.
Only version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability.
Application update was released in April 2025.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://cert.pl/en/posts/2025/05/CVE-2024-13915 |
Configurations
No configuration.
History
03 Oct 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-926 |
10 Jun 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-30 16:15
Updated : 2025-10-03 09:15
NVD link : CVE-2024-13916
Mitre link : CVE-2024-13916
CVE.ORG link : CVE-2024-13916
JSON object : View
Products Affected
No product.
CWE
CWE-926
Improper Export of Android Application Components