CVE-2025-68710

Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome), resulting in information disclosure and privilege escalation.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/actuator/locker.app.safe.applocker
https://github.com/actuator/locker.app.safe.applocker/blob/main/CVE-2025-68710
https://play.google.com/store/apps/details?id=locker.app.safe.applocker

Configurations

No configuration.

History

24 Jul 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Easyelife App lock (también conocido como Fingerprint,Applock o locker.app.safe.applocker) 1.9.2 para Android permite a un atacante local con acceso físico eludir el bloqueo por PIN. El bloqueo se implementa como una superposición en lugar de utilizar las API de autenticación seguras de Android. Al navegar por flujos de interfaz en cascada - la navegación insegura a través de rutas expuestas facilita la evasión del control de la aplicación {I.N.T.E.R.F.A.C.E] a través de anuncios o intents del navegador - un atacante puede evadir la verificación de la pantalla de bloqueo y acceder a aplicaciones protegidas (por ejemplo, Chrome), lo que resulta en revelación de información y escalada de privilegios.

27 May 2026, 21:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 2.4
CWE		CWE-288

26 May 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-26 20:16

Updated : 2026-07-24 11:10

NVD link : CVE-2025-68710

Mitre link : CVE-2025-68710

CVE.ORG link : CVE-2025-68710

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2025-68710", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68710", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T20:34:17.976943Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-26T20:16:16.317", "references": [{"url": "https://github.com/actuator/locker.app.safe.applocker", "source": "cve@mitre.org"}, {"url": "https://github.com/actuator/locker.app.safe.applocker/blob/main/CVE-2025-68710", "source": "cve@mitre.org"}, {"url": "https://play.google.com/store/apps/details?id=locker.app.safe.applocker", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome), resulting in information disclosure and privilege escalation."}, {"lang": "es", "value": "Easyelife App lock (tambi\u00e9n conocido como Fingerprint,Applock o locker.app.safe.applocker) 1.9.2 para Android permite a un atacante local con acceso f\u00edsico eludir el bloqueo por PIN. El bloqueo se implementa como una superposici\u00f3n en lugar de utilizar las API de autenticaci\u00f3n seguras de Android. Al navegar por flujos de interfaz en cascada - la navegaci\u00f3n insegura a trav\u00e9s de rutas expuestas facilita la evasi\u00f3n del control de la aplicaci\u00f3n {I.N.T.E.R.F.A.C.E] a trav\u00e9s de anuncios o intents del navegador - un atacante puede evadir la verificaci\u00f3n de la pantalla de bloqueo y acceder a aplicaciones protegidas (por ejemplo, Chrome), lo que resulta en revelaci\u00f3n de informaci\u00f3n y escalada de privilegios."}], "lastModified": "2026-07-24T11:10:00.170", "sourceIdentifier": "cve@mitre.org"}