Ulefone and Krüger&Matz Smartphones Factory Reset Vulnerability in Preloaded Application

A vulnerability has been identified in a preloaded application called 'com.pri.factorytest' on Android-based smartphones from Ulefone and Krüger&Matz. This application, which includes version 1.0, exposes a service that allows any application to perform a factory reset on the device. The issue arises from improper export of Android application components, enabling unauthorized access to sensitive functions. The vulnerable application was bundled with OS releases after December 2024 for Ulefone and likely in March 2025 for Krüger&Matz, although the latter has not been confirmed.

Impact

Exploitation of this vulnerability allows any application to initiate a factory reset, potentially leading to unauthorized data loss and device reset.