PT-2025-23312 · Unknown · Com.Pri.Applock

Szymon Chadam · Published 2025-05-30 · Updated 2025-06-13 · CVE-2024-13917

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions com.pri.applock version 13 (version code: 33)

Description The issue allows a malicious application to inject an arbitrary intent with system-level privileges to a protected application. This can be done by exploiting the exposed "com.pri.applock.LockUI" activity, which does not require any granted Android system permissions. To successfully inject the intent, the malicious application must know the protecting PIN number or ask the user to provide it.

Recommendations For version 13 (version code: 33), consider restricting access to the com.pri.applock.LockUI activity to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-926

Related Identifiers

CVE-2024-13917

Affected Products

Com.Pri.Applock

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-13917 · Security Note
• https://t.me/cvenotify/125219 · Telegram Post
• https://twitter.com/CveFindCom/status/1928476523125706901 · Twitter Post
• https://cert.pl/en/posts/2025/05/CVE-2024-13915 · Note
• https://t.me/purp_sec/727 · Telegram Post
• https://twitter.com/PreEmptive/status/1933525012796911622 · Twitter Post
• https://t.me/cvetracker/25028 · Telegram Post
• https://twitter.com/CVEnew/status/1928475332660678956 · Twitter Post
• https://twitter.com/instantvidget/status/1929873669762813997 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1928543878132518964 · Twitter Post