« Volver al listado

CVE-2025-14817

Estado: AnalizadaMedia (6.5)—

The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party apps which can construct intents to directly open adb debugging functionality without user interaction.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Transsion — Hios

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-14817",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-14817",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-17T18:47:23.957146Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea",
      "affectedData": [
        {
          "vendor": "TECNO",
          "product": "Tecno Pova6 Pro 5G",
          "versions": [
            {
              "status": "affected",
              "version": "HiOS V14.0.0"
            }
          ],
          "packageName": "com.transsion.tranfacmode",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-17T07:15:58.817",
  "references": [
    {
      "url": "https://security.tecno.com/SRC/blogdetail/434?lang=en_US",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea"
    },
    {
      "url": "https://security.tecno.com/SRC/securityUpdates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party apps which can construct intents to directly open adb debugging functionality without user interaction."
    },
    {
      "lang": "es",
      "value": "El componente com.transsion.tranfacmode.entrance.main.MainActivity en com.transsion.tranfacmode no tiene control de permisos y puede ser accedido por aplicaciones de terceros, las cuales pueden construir intents para abrir directamente la funcionalidad de depuración adb sin interacción del usuario."
    }
  ],
  "lastModified": "2026-09-28T10:10:00.473",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:transsion:hios:14.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7CBD79E-AFEA-4D10-8668-079D5EF0FB12"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:transsion:tecno_pova6_pro_5g:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A37EA557-787C-44F6-B643-C15865514DFE"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea"
}