CVE-2025-9135
📋 TL;DR
This vulnerability allows improper export of Android application components in multiple Austrian public transport apps, enabling local attackers to potentially intercept or manipulate app data. It affects users of Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim, and Salzburg Verkehr apps on Android devices. The vulnerability stems from task affinity settings in AndroidManifest.xml that allow app copying.
💻 Affected Systems
- Verkehrsauskunft Österreich SmartRide
- cleVVVer
- BusBahnBim
- Salzburg Verkehr
📦 What is this software?
Smartride by Verkehrsauskunft
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access to the device could copy the app and intercept sensitive user data including travel information, payment details, or authentication tokens.
Likely Case
Malicious apps on the same device could exploit exported components to access app data or functionality without proper permissions.
If Mitigated
With proper Android security controls and app sandboxing, impact is limited to data leakage within the compromised app's scope.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Requires local access to device and some technical knowledge of Android app structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1.2(259)
Vendor Advisory: Not provided in CVE details
Restart Required: No
Instructions:
1. Open Google Play Store 2. Search for affected app 3. Check if update to 12.1.2(259) is available 4. Install update 5. Verify version in app settings
🔧 Temporary Workarounds
Disable app task affinity via ADB
AndroidManually modify app task affinity settings using Android Debug Bridge
adb shell pm clear [app_package_name]
adb shell am task lock [task_id]
🧯 If You Can't Patch
- Uninstall affected apps until patched version is available
- Enable Android Verify Apps feature and only install from Google Play Store
🔍 How to Verify
Check if Vulnerable:
Check app version in Android Settings > Apps > [App Name] > App Info. If version is 12.1.1(258) or lower, app is vulnerable.Check Version:
adb shell dumpsys package [app_package_name] | grep versionNameVerify Fix Applied:
Verify app version shows 12.1.2(259) or higher in app settings. Check that task affinity is properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unexpected app cloning attempts
- Multiple instances of same app running
- Permission violations in app sandbox
Network Indicators:
- Unusual app data transmission patterns
- Multiple app instances communicating simultaneously
SIEM Query:
app:"de.hafas.android.vvt" AND event_type:"permission_violation" OR "app_clone_attempt"🔗 References
- https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md
- https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md#steps-to-reproduce
- https://vuldb.com/?ctiid.320515
- https://vuldb.com/?id.320515
- https://vuldb.com/?submit.615276
- https://vuldb.com/?submit.615278
- https://vuldb.com/?submit.628235
- https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md
- https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md#steps-to-reproduce
