CVE-2025-21615

AAT allows data exfiltration by other apps installed on the same device

CVSS 5.5 MEDIUMEPSS 0.2%CWE-200

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

06 jan 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Produtos afetados

bailuk · AAT

Referências

https://github.com/bailuk/AAT/security/advisories/GHSA-pwpm-x58v-px5c