CVE-2025-9135

MEDIUM

Verkehrsauskunft Österreich Apps <12.1.1(258) - Info Disclosure

Title source: llm
STIX 2.1

Description

A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1(258) on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper export of android application components. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 12.1.2(259) is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor was contacted early and fixed the issue by "[r]emoving the task affinity of the app so it can't be copied".

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.320515
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.320515
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.615276
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.615278
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.628235

Scores

CVSS v3 5.3
EPSS 0.0026
EPSS Percentile 16.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-926
Status published
Products (1)
verkehrsauskunft/smartride < 12.1.2\(259\)
Published Aug 19, 2025
Tracked Since Feb 18, 2026