CVE-2025-5345

6.3 mediumEPSS 0.1%

Medium (6.3). EPSS 0.1% chance of exploitation in the next 30 days.

Bluebird devices contain a pre-loaded file manager application. This application exposes an unsecured service provider "com.bluebird.system.koreanpost.IsdcardRemoteService". A local attacker can bind to the AIDL-type service to copy and delete arbitrary files from device's storage with system-level permissions. Version 1.4.4 is vulnerable, vendor reverted vulnerable versions to older version: 1.3.6

Severity

CVSS 4.0

6.3 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
CWE: CWE-926
Published: 2025-07-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://cert.pl/en/posts/2025/07/CVE-2025-5344

Check your stack JSON