Security Flaw in Kruger&Matz Smartphones Affecting App Encryption
CVE-2024-13917

8.3HIGH

Key Information:

Vendor

Kruger&matz

Status
Com.pri.applock
Vendor
CVE Published:
30 May 2025

What is CVE-2024-13917?

A flaw in the com.pri.applock application, pre-loaded on Kruger&Matz smartphones, allows unauthorized access to encrypt applications using a user-provided PIN or biometric data. The exposed LockUI activity enables any unauthorized application, without needing specific Android system permissions, to inject potentially harmful intents with elevated privileges to manipulate protected applications. Attackers may leverage knowledge of the user's protecting PIN or trick users into revealing it, exacerbating the security risk.

Affected Version(s)

com.pri.applock 13

References

https://cert.pl/en/posts/2025/05/CVE-2024-13915
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Szymon Chadam
.