PT-2025-29906 · Unknown · Bluebird Devices

Szymon Chadam · Published 2025-07-17 · Updated 2025-07-17 · CVE-2025-5345

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Bluebird devices version 1.4.4 Bluebird devices version 1.3.6

Description Bluebird devices contain a pre-loaded file manager application that exposes an unsecured service provider com.bluebird.system.koreanpost.IsdcardRemoteService. A local attacker can bind to the AIDL-type service to copy and delete arbitrary files from the device's storage with system-level permissions.

Recommendations Update Bluebird devices from version 1.4.4 to a newer, non-vulnerable version. Revert Bluebird devices from version 1.4.4 to version 1.3.6.

Fix

Weakness Enumeration

CWE-926

Related Identifiers

CVE-2025-5345

Affected Products

Bluebird Devices

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-5345 · Security Note
• https://t.me/cvetracker/28026 · Telegram Post
• https://cert.pl/en/posts/2025/07/CVE-2025-5344 · Note
• https://twitter.com/CVEnew/status/1945834443140166082 · Twitter Post