CVE-2025-5344: Exposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk application

Severity: high (CVSS 8.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-17 · updated 2026-06-17
Weakness: CWE-926

Description

Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemoteService". A local attacker can bind to the AIDL-type service to modify device's global settings and wallpaper image. This issue affects all versions before 1.1.2.

Affected products

Bluebird com.bluebird.kiosk.launcher: before 1.1.2 — fixed in 1.1.2

How to fix

Upgrade to a fixed version: Bluebird com.bluebird.kiosk.launcher 1.1.2. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2025/07/CVE-2025-5344

Get alerted when CVE-2025-5344 or the next vulnerability affects your stack