CVE-2025-43976
📋 TL;DR
This vulnerability in the TextNow application for Android allows any installed app without permissions to initiate phone calls without user interaction by sending a crafted intent. It affects Android users running TextNow version 24.17.1.0 and earlier, potentially enabling unauthorized call placement.
💻 Affected Systems
- com.enflick.android.tn2ndLine (TextNow)
📦 What is this software?
2ndline by Textnow
⚠️ Risk & Real-World Impact
Worst Case
Malicious apps could place premium-rate calls, incurring significant charges, or make calls to emergency services causing service disruption.
Likely Case
Malware or compromised apps could make unauthorized calls to toll numbers, resulting in financial loss for the user.
If Mitigated
With proper app sandboxing and intent filtering, the impact is limited to potential nuisance calls.
🎯 Exploit Status
Exploitation requires installing a malicious app but no user interaction during call placement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 24.17.1.0
Vendor Advisory: https://play.google.com/store/apps/details?id=com.enflick.android.tn2ndLine
Restart Required: No
Instructions:
1. Open Google Play Store 2. Search for TextNow 3. Update to latest version 4. Verify version is newer than 24.17.1.0
🔧 Temporary Workarounds
Uninstall TextNow
androidRemove the vulnerable application entirely
adb uninstall com.enflick.android.tn2ndLine
Disable TextNow dialer component
androidUse Android's pm command to disable the vulnerable activity
adb shell pm disable-user --user 0 com.enflick.android.tn2ndLine/com.enflick.android.TextNow.activities.DialerActivity
🧯 If You Can't Patch
- Restrict installation of unknown apps and review installed applications
- Monitor phone bill for unexpected call charges
🔍 How to Verify
Check if Vulnerable:
Check TextNow version in app settings or via: adb shell dumpsys package com.enflick.android.tn2ndLine | grep versionNameCheck Version:
adb shell dumpsys package com.enflick.android.tn2ndLine | grep versionNameVerify Fix Applied:
Confirm version is newer than 24.17.1.0 and test intent filtering📡 Detection & Monitoring
Log Indicators:
- Unexpected intent calls to DialerActivity
- Phone calls initiated without user interaction in logs
Network Indicators:
- Unexpected outbound calls from TextNow app
SIEM Query:
source="android_logs" AND "com.enflick.android.TextNow.activities.DialerActivity" AND intent