Krüger&Matz Smartphones com.pri.applock Application PIN Code Exfiltration Vulnerability

A vulnerability exists in the pre-loaded 'com.pri.applock' application on Krüger&Matz smartphones, specifically in version 13 (version code 33). The application allows users to encrypt other applications using a PIN code or biometric data. However, the 'com.android.providers.settings.fingerprint.PriFpShareProvider' content provider exposes a public method that enables malicious applications to exfiltrate the PIN code without requiring any special Android system permissions.

Impact

Exploitation of this vulnerability allows for unauthorized access to user-provided PIN codes, potentially leading to unauthorized decryption of applications encrypted with those PINs.