CVE-2025-8745
📋 TL;DR
This vulnerability in Weee RICEPO App 6.17.77 on Android allows improper export of Android application components via AndroidManifest.xml manipulation. Attackers with local access can potentially access sensitive app components, affecting users of this specific Android app version.
💻 Affected Systems
- Weee RICEPO App
📦 What is this software?
Ricepo by Sayweee
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains unauthorized access to sensitive app components, potentially leading to data theft or privilege escalation within the app.
Likely Case
Limited information disclosure or unauthorized access to non-critical app components by users with physical device access.
If Mitigated
Minimal impact if app is not installed or proper device security controls prevent unauthorized local access.
🎯 Exploit Status
Exploit details publicly disclosed; requires local access to Android device and knowledge of Android component manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: NONE
Restart Required: No
Instructions:
No official patch available; vendor did not respond to disclosure. Consider removing the app until updated version is released.
🔧 Temporary Workarounds
Uninstall vulnerable app
androidRemove Weee RICEPO App 6.17.77 from Android devices
adb uninstall com.ricepo.app
Restrict app permissions
androidLimit app permissions in Android settings to minimum required
🧯 If You Can't Patch
- Implement device security controls to prevent unauthorized local access
- Monitor for suspicious app activity or unauthorized component access attempts
🔍 How to Verify
Check if Vulnerable:
Check app version in Android settings > Apps > Weee RICEPO App > App infoCheck Version:
adb shell dumpsys package com.ricepo.app | grep versionNameVerify Fix Applied:
Verify app is uninstalled or updated to version later than 6.17.77📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to com.ricepo.app components in Android logs
Network Indicators:
- N/A - Local vulnerability only
SIEM Query:
N/A - Local device-level monitoring required🔗 References
- https://github.com/KMov-g/androidapps/blob/main/com.ricepo.app.md
- https://github.com/KMov-g/androidapps/blob/main/com.ricepo.app.md#steps-to-reproduce
- https://vuldb.com/?ctiid.319241
- https://vuldb.com/?id.319241
- https://vuldb.com/?submit.623581
- https://github.com/KMov-g/androidapps/blob/main/com.ricepo.app.md
