CVE-2025-14817

CVE-2025-14817: Factory Mode App Exists Privilege Escalation Issue Allowing Third-Party Apps to Open ADB

Vendor Tecno

Product Tecno Pova6 Pro 5G

Weakness CWE-862 · Missing authorization

Published December 17, 2025

Last update December 17, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party apps which can construct intents to directly open adb debugging functionality without user interaction.

Key dates

02Disclosure timeline

December 17, 2025 CVE published

December 17, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-14817 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2022-3489 WP Hide <= 0.0.2 - Unauthenticated Settings Update CVE-2025-67967 WordPress Lawyer Directory plugin <= 1.3.3 - Broken Access Control vulnerability CVE-2025-66112 WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerability CVE-2026-24551 WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability CVE-2026-45442 WordPress Presto Player plugin <= 4.1.3 - Broken Access Control vulnerability