CVE-2025-5344 HIGH

CVE-2025-5344: Exposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk application

Vendor Bluebird

Product com.bluebird.kiosk.launcher

Weakness CWE-926

Published July 17, 2025

Last update July 17, 2025

View on NVD All CVEs

CVSS base score

8.5/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemoteService". A local attacker can bind to the AIDL-type service to modify device's global settings and wallpaper image. This issue affects all versions before 1.1.2.

Key dates

02Disclosure timeline

July 17, 2025 CVE published

July 17, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-5344 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/926.html

Related vulnerabilities

04Related CVE

CVE-2025-7892 IDnow App de.idnow AndroidManifest.xml improper export of android application components CVE-2024-13916 Exposure of Applications' Encryption PINs in Kruger&Matz AppLock CVE-2025-7940 Genshin Albedo Cat House App com.house.auscat AndroidManifest.xml improper export of android application components CVE-2025-9675 Voice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application components CVE-2025-5500 ZhenShi Mibro Fit App com.xiaoxun.xunoversea.mibrofit AndroidManifest.xml improper export of android application components