PT-2025-33409 · Lotus Cars · Lotus Cars Android App

Jack Sessions + 1 · Published 2025-08-14 · Updated 2025-08-16 · CVE-2025-50861

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Lotus Cars Android App version 1.2.8

Description: The Lotus Cars Android app (com.lotus.carsdomestic.intl) version 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps. This can lead to unintended access to application internals, potentially causing denial of service or logic abuse.

Recommendations: Update to a newer version of the Lotus Cars Android App that addresses this issue.

Exploit

Fix

DoS

Improper Access Control

Resource Exhaustion

Weakness Enumeration

CWE-284

CWE-400

Related Identifiers

CVE-2025-50861

Affected Products

Lotus Cars Android App

References · 6

• 🔥 https://github.com/JackSessions/Jack-Sessions-CVEs/tree/main · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-50861 · Security Note
• https://t.me/CVEtracker/30049 · Telegram Post
• http://comlotuscarsdomesticintl.com · Note
• http://lotus.com · Note
• https://twitter.com/CVEnew/status/1956654832401682477 · Twitter Post