Bluebird Devices Barcode Scanner Application BootReceiver Overwrite Vulnerability

A vulnerability exists in Bluebird devices with a pre-loaded barcode scanner application, prior to version 1.3.3. The issue arises from an unsecured broadcast receiver, 'kr.co.bluebird.android.bbsettings.BootReceiver', which allows local attackers to overwrite any file containing the '.json' keyword. This is achieved by replacing it with a default barcode configuration file. The vulnerability is exacerbated by a lack of protection against path traversal, enabling file overwrites in any location.

Impact

Exploitation of this vulnerability allows for arbitrary file overwriting, potentially leading to disruption of application functionality or user data.