CVE-2025-9135
LOW EPSS 17.0%
Published Aug 19, 202510mo ago · Modified Jun 17, 20262w ago
1.9 CVSS 4.0
Published Aug 19, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago
Description
A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1(258) on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper export of android application components. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 12.1.2(259) is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor was contacted early and fixed the issue by "[r]emoving the task affinity of the app so it can't be copied".
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
17.0% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-926
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| verkehrsauskunft | smartride | * | <12.1.2\(259\) |
References 7
- github.com https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md
- github.com https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md#steps-to-reproduce
- vuldb.com https://vuldb.com/?ctiid.320515
- vuldb.com https://vuldb.com/?id.320515
- vuldb.com https://vuldb.com/?submit.615276
- vuldb.com https://vuldb.com/?submit.615278
- vuldb.com https://vuldb.com/?submit.628235
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.