CVE-2025-7892
📋 TL;DR
This vulnerability in IDnow App for Android allows improper export of application components via AndroidManifest.xml, potentially enabling local attackers to access sensitive app functionality. It affects Android users running IDnow App versions up to 9.6.0. The vulnerability requires local device access to exploit.
💻 Affected Systems
- IDnow App
📦 What is this software?
Idnow by Idnow
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains unauthorized access to sensitive app components, potentially accessing user verification data or performing actions within the app context.
Likely Case
Local malware or malicious apps could exploit this to interact with IDnow App components, potentially accessing limited app functionality or user data.
If Mitigated
With proper Android security controls and app sandboxing, impact is limited to the app's own data and functionality.
🎯 Exploit Status
Exploit disclosed publicly on GitHub; requires local access to device; vendor unresponsive to disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor vendor for updates to IDnow App beyond version 9.6.0.
🔧 Temporary Workarounds
Uninstall vulnerable app
androidRemove IDnow App version 9.6.0 or earlier from Android devices
adb uninstall de.idnow
Restrict app permissions
androidLimit app permissions in Android settings to minimum required
🧯 If You Can't Patch
- Isolate devices with vulnerable app from sensitive networks
- Implement mobile device management (MDM) controls to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Android device for IDnow App version 9.6.0 or earlier in Settings > AppsCheck Version:
adb shell dumpsys package de.idnow | grep versionNameVerify Fix Applied:
Verify IDnow App version is greater than 9.6.0 or app is uninstalled📡 Detection & Monitoring
Log Indicators:
- Unusual activity in IDnow App logs
- Unauthorized component access attempts
Network Indicators:
- None - local vulnerability only
SIEM Query:
app:"IDnow" AND version:"<=9.6.0" AND event_type:"security_violation"🔗 References
- https://github.com/KMov-g/androidapps/blob/main/de.idnow.md
- https://github.com/KMov-g/androidapps/blob/main/de.idnow.md#steps-to-reproduce
- https://vuldb.com/?ctiid.317007
- https://vuldb.com/?id.317007
- https://vuldb.com/?submit.615279
- https://github.com/KMov-g/androidapps/blob/main/de.idnow.md
- https://github.com/KMov-g/androidapps/blob/main/de.idnow.md#steps-to-reproduce
