CVE-2025-9135

Verkehrsauskunft Österreich SmartRide/cleVVVer/BusBahnBim/Salzburg Verkehr AndroidManifest.xml improper export of android application components

State: Published
Severity: 4.8 Medium
Published: Aug 19, 2025
Updated: Sep 13, 2025
Reserved: Aug 19, 2025

Read the record on cve.org

Description

A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1(258) on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper export of android application components. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 12.1.2(259) is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor was contacted early and fixed the issue by "[r]emoving the task affinity of the app so it can't be copied".

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-926 Improper Export of Android Application Components

Affected Products

Product	Versions
SmartRideVerkehrsauskunft Österreich	12.1.1(258)Affected 12.1.2(259)Not affected
cleVVVerVerkehrsauskunft Österreich	12.1.1(258)Affected 12.1.2(259)Not affected
BusBahnBimVerkehrsauskunft Österreich	12.1.1(258)Affected 12.1.2(259)Not affected
Salzburg VerkehrVerkehrsauskunft Österreich	12.1.1(258)Affected 12.1.2(259)Not affected

References

VDB-320515 | Verkehrsauskunft Österreich SmartRide/cleVVVer/BusBahnBim/Salzburg Verkehr AndroidManifest.xml improper export of android application componentsvdb-entrytechnical-description
VDB-320515 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #615276 | Verkehrsauskunft Österreich SmartRide 12.1.1(258) Task Hijackingthird-party-advisory
Submit #615278 | Verkehrsauskunft Österreich cleVVVer(de.hafas.android.vvv) 12.1.1(258) Task Hijacking (Duplicate)third-party-advisory
Submit #628235 | Verkehrsauskunft Österreich BusBahnBim(de.hafas.android.stv) 12.1.1(258) Hijacking (Duplicate)third-party-advisory
https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.mdrelated
https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md#steps-to-reproduceexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.