PT-2025-33720 · Unknown+1 · Busbahnbim+2

Fxizenta · Published 2025-08-19 · Updated 2025-09-13 · CVE-2025-9135

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Verkehrsauskunft Österreich SmartRide versions up to 12.1.1(258) cleVVVer versions up to 12.1.1(258) BusBahnBim versions up to 12.1.1(258)

Description: A vulnerability exists related to the improper export of Android application components due to manipulation of an unknown function within the AndroidManifest.xml file. The attack requires local access. The exploit is publicly available.

Recommendations: Upgrade Verkehrsauskunft Österreich SmartRide to version 12.1.2(259). Upgrade cleVVVer to version 12.1.2(259). Upgrade BusBahnBim to version 12.1.2(259). Update the affected component.

Exploit

Fix

Weakness Enumeration

CWE-926

Related Identifiers

CVE-2025-9135

Affected Products

Busbahnbim

Verkehrsauskunft Österreich Smartride

Clevvver

References · 14

• 🔥 https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md#steps-to-reproduce · Exploit
• 🔥 https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-9135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9135 · Security Note
• https://t.me/cveNotify/132771 · Telegram Post
• https://vuldb.com/?submit.628235 · Note
• https://vuldb.com/?ctiid.320515 · Note
• https://vuldb.com/?id.320515 · Note
• https://vuldb.com/?submit.615276 · Note
• https://t.me/cveNotify/133136 · Telegram Post
• https://t.me/cveNotify/135377 · Telegram Post
• https://t.me/cveNotify/135265 · Telegram Post
• https://t.me/CVEtracker/30345 · Telegram Post
• https://vuldb.com/?submit.615278 · Note