CVE-2025-27214

The CVE-2025-27214 entry concerns UniFi Connect EV Station Pro (versions up to 1.5.18) where a Missing Authentication for Critical Function vulnerability could allow a nearby or physically present attacker to trigger an unauthorized factory reset. The core issue is lack of authentication for crit...

Ubiquiti UniFi Connect EV Station 安全漏洞

Ubiquiti UniFi Connect EV Station is an electric vehicle station from Ubiquiti USA. A security vulnerability exists in the Ubiquiti UniFi Connect EV Station version 1.5.18 and earlier, which stems from a lack of authentication for critical functions and could result in an unauthorized restoration...

CVE-2025-8286

CVE-2025-8286 affects Güralp FMUS series seismic monitoring devices. The vulnerability is an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device. Affected products are exposed via a networ...

CVE-2025-32879

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device...

Preinstalled Apps on Ulefone, Krüger&Matz Phones Let Any App Reset Device, Steal PIN

Three security vulnerabilities have been disclosed in preloaded Android applications on smartphones from Ulefone and Krüger&Matz that could enable any app installed on the device to perform a factory reset and encrypt an application. A brief description of the three flaws is as follows -...

CVE-2024-13915

Android based smartphones from vendors such as Ulefone and Krüger contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" version name: 1.0, version code: 1 exposes a ”com.pri.factorytest.emmc.FactoryResetService“ servic...

CVE-2024-13915

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" version name: 1.0, version code: 1 exposes a ”com.pri.factorytest.emmc.FactoryResetService“...

CVE-2024-13915 Unrestricted Access to Exported Service in com.pri.factorytest

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" version name: 1.0, version code: 1 exposes a ”com.pri.factorytest.emmc.FactoryResetService“...

CVE-2024-13915 Unrestricted Access to Exported Service in com.pri.factorytest

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" version name: 1.0, version code: 1 exposes a ”com.pri.factorytest.emmc.FactoryResetService“...

CVE-2024-13915

CVE-2024-13915 describes preloaded Android apps on Ulefone and Krüger&Matz devices where com.pri.factorytest exposes com.pri.factorytest.emmc.FactoryResetService, allowing any installed app to trigger a device factory reset. Affected behavior is explicitly stated; the entry notes that the APK ver...

PT-2025-23310 · Unknown · Com.Pri.Factorytest

Name of the Vulnerable Software and Affected Versions: com.pri.factorytest versions 1.0 Android smartphones from Ulefone and Krüger&Matz affected versions not specified Description: The issue concerns an application "com.pri.factorytest" preloaded onto Android smartphones from vendors such as...

Krüger&Matz com.pri.factorytest和Ulefone com.pri.factorytest 安全漏洞

Krüger&Matz com.pri.factorytest is a mobile application component from Krüger&Matz.Ulefone com.pri.factorytest is a cell phone component from Ulefone. A security vulnerability exists in Krüger&Matz com.pri.factorytest and Ulefone com.pri.factorytest, which stems from a pre-installed...

The vulnerability of the SSH protocol implementation in D-Link DWR-M972V router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the SSH protocol implementation in D-Link DWR-M972V router microprogramming devices lies in the possibility of resetting settings to their factory defaults due to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-30939

An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control of an account via a flaw in the factory reset procedure...

CVE-2024-20871

Improper authorization vulnerability in Samsung Keyboard prior to version One UI 5.1.1 allows physical attackers to partially bypass the factory reset protection...

CVE-2024-40672

In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-40677

In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2024-49736

In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-46340

TL-WR845NUNV4201214, TP-Link TL-WR845NUNV4200909, and TL-WR845NUNV4190219 was discovered to transmit user credentials in plaintext after executing a factory reset...

CVE-2024-10576

Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver. An attacker can communicate with the receiver and force the device to perform a factory reset without any Android system permissions. After multiple attempts to contact th...