CVE-2025-5344 — Exposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk application

CVE-2025-5344

Exposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk application PUBLISHED

Description (CNA)

Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemoteService". A local attacker can bind to the AIDL-type service to modify device's global settings and wallpaper image. This issue affects all versions before 1.1.2.

Affected (CNA)

Vendor / product	Versions
Bluebird / com.bluebird.kiosk.launcher	affected 0 before 1.1.2

CWE

CWE-926

References

https://cert.pl/en/posts/2025/07/CVE-2025-5344

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.