PT-2026-23865 · Unknown+1 · Ethoslauncher+1

Vuldb · Published 2026-03-07 · Updated 2026-03-07 · CVE-2026-3667

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Freedom Factory dGEN1 versions up to 20260221

Description A security flaw exists in Freedom Factory dGEN1 up to version 20260221. The issue resides within the FakeAppService function of the org.ethosmobile.ethoslauncher component, leading to improper authorization. The attack requires local access. The exploit is publicly available. The vendor was informed of the issue but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-3667

Affected Products

Dgen1

Ethoslauncher

References · 8

• 🔥 https://gist.github.com/Lytes/571902a31a3d543da009554a82f2d00c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3667 · Security Note
• https://gist.github.com/Lytes/a94219fa1de3f5173555d5a3e8058f01 · Note
• https://t.me/CVEtracker/46736 · Telegram Post
• https://vuldb.com/?id.349555 · Note
• https://vuldb.com/?ctiid.349555 · Note
• https://vuldb.com/?submit.764699 · Note
• https://twitter.com/CVEnew/status/2030339297338179734 · Twitter Post