Security Flaws in Preinstalled Apps on Ulefone and Krüger&Matz Smartphones Enable Malicious Actions
On June 2, 2025, significant security vulnerabilities were uncovered in pre-installed applications on smartphones manufactured by Ulefone and Krüger&Matz. These vulnerabilities could potentially allow any application downloaded onto these devices to conduct a factory reset or encrypt other applications using unauthorized access to sensitive user data.
The first vulnerability, identified as CVE-2024-13915 and rated with a CVSS score of 6.9, arises from a component of the “com.pri.factorytest” application. This app features a factory reset service, “com.pri.factorytest.emmc.FactoryResetService,” which inadvertently permits any installed application to execute a factory reset on the device. This flaw underscores a severe risk, as it effectively permits any user-installed app to erase all data, potentially leaving the device vulnerable to malicious exploitation.
The second vulnerability, referenced as CVE-2024-13916 and also scoring 6.9 on the CVSS scale, is found within the “com.pri.applock” application on Krüger&Matz devices. This application allows users to encrypt any app with a PIN code or biometric information. However, it exposes the “query()” method of the “com.android.providers.settings.fingerprint.PriFpShareProvider,” enabling a malicious app to access and utilize this sensitive fingerprint data. This capability not only poses a significant threat to personal privacy but can also facilitate unauthorized app encryption, thereby complicating the recovery of critical data.
The primary targets of these vulnerabilities include users of smartphones by Ulefone and Krüger&Matz, with potential ramifications extending to all individuals who engage with apps installed on these devices. The widespread nature of this vulnerability could give rise to a range of security concerns, particularly for businesses that utilize these devices for operations.
Both Ulefone and Krüger&Matz are based in Eastern Europe, a region often noted for its growing technology sector. These findings point to a broader issue within the mobile landscape where preinstalled applications can serve as vectors for significant security risks.
In terms of potential adversary tactics outlined in the MITRE ATT&CK framework, the vulnerabilities allow for initial access via user-installed applications that exploit the flaws in the preinstalled ones. Furthermore, the weaknesses represent opportunities for privilege escalation, as any malicious app could gain excessive control over data and functionality on the device.
Business owners, particularly those in sectors that leverage mobile technology, should remain vigilant in monitoring how these vulnerabilities may impact their operations. The likelihood of exploitation emphasizes the need for enhanced security measures and practices, ensuring that all applications—especially pre-installed ones—are scrutinized for potential weaknesses that could compromise sensitive information or disrupt business continuity.
In summary, the vulnerabilities identified in Ulefone and Krüger&Matz smartphones raise critical questions about device security in the mobile ecosystem. Businesses must take proactive steps to safeguard sensitive data against the threats posed by malicious applications and unauthorized access.
