CVE-2025-5346: File removal via path traversal in unsecured broadcast receiver in Bluebird barcode scanner application

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-17 · updated 2026-06-17
Weakness: CWE-926

Description

Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver "kr.co.bluebird.android.bbsettings.BootReceiver". A local attacker can call the receiver to overwrite file containing ".json" keyword with default barcode config file. It is possible to overwrite file in any location due to lack of protection against path traversal in name of the file. This issue affects all versions before 1.3.3.

Affected products

Bluebird kr.co.bluebird.android.bbsettings: before 1.3.3 — fixed in 1.3.3

How to fix

Upgrade to a fixed version: Bluebird kr.co.bluebird.android.bbsettings 1.3.3. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2025/07CVE-2025-5344

Get alerted when CVE-2025-5346 or the next vulnerability affects your stack