CVE-2025-5346

Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver "kr.co.bluebird.android.bbsettings.BootReceiver". A local attacker can call the receiver to overwrite file containing ".json" keyword with default barcode config file. It is possible to overwrite file in any location due to lack of protection against path traversal in name of the file. This issue affects all versions before 1.3.3.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2025/07CVE-2025-5344

Configurations

No configuration.

History

17 Jul 2025, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-17 13:15

Updated : 2025-07-17 21:15

NVD link : CVE-2025-5346

Mitre link : CVE-2025-5346

CVE.ORG link : CVE-2025-5346

JSON object : View

Products Affected

No product.

CWE

CWE-926

Improper Export of Android Application Components

{"id": "CVE-2025-5346", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-17T13:15:23.383", "references": [{"url": "https://cert.pl/en/posts/2025/07CVE-2025-5344", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-926"}]}], "descriptions": [{"lang": "en", "value": "Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver \"kr.co.bluebird.android.bbsettings.BootReceiver\". A local attacker can call the receiver to overwrite file containing \".json\" keyword with default barcode config file. It is possible to overwrite file in any location due to lack of protection against path traversal in name of the file.\n\nThis issue affects all versions before 1.3.3."}], "lastModified": "2025-07-17T21:15:50.197", "sourceIdentifier": "cvd@cert.pl"}

CVE-2025-5346

JSON object

Attach tags to CVE-2025-5346

Attach tags to `CVE-2025-5346`