Description
Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemoteService". A local attacker can bind to the AIDL-type service to modify device's global settings and wallpaper image.
This issue affects all versions before 1.1.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bluebird | com.bluebird.kiosk.launcher | < 1.1.2 | 1.1.2 |
References
- https://cert.pl/en/posts/2025/07/CVE-2025-5344 third-party-advisory