Unsecured Service Provider in Bluebird Devices Kiosk Application
CVE-2025-5344

8.5HIGH

Key Information:

Vendor

Bluebird

Status
Com.bluebird.kiOSk.launcher
Vendor
CVE Published:
17 July 2025

What is CVE-2025-5344?

The Bluebird devices feature a kiosk application that includes an unsecured service provider identified as 'com.bluebird.kiosk.launcher.IpartnerKioskRemoteService.' This vulnerability allows local attackers to bind to the AIDL-type service, potentially enabling them to alter the device's global settings, including wallpaper images. All versions prior to 1.1.2 are subject to this risk.

Affected Version(s)

com.bluebird.kiosk.launcher Android 0 < 1.1.2

References

https://cert.pl/en/posts/2025/07/CVE-2025-5344
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Szymon Chadam
.
CVE-2025-5344 : Unsecured Service Provider in Bluebird Devices Kiosk Application