Transsion HiOS CVE-2025-14817
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
DeliveryCraft explicit intent to exported MainActivity
-
ExploitLaunch component lacking permission control
-
ExecutionADB debugging enabled silently
-
ImpactLeverage ADB for broader device access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a malicious or compromised third-party application to already be installed on the same Transsion HiOS 14.0.0 device; that app then sends an explicit Android intent to the exported, unprotected com.transsion.tranfacmode.entrance.main.MainActivity. The specific enabling defect is the absence of any permission declaration/permission check on this activity, allowing external apps to invoke it. Limiting factors: it is local to the device (attacker needs code execution as an installed app, not remote network access), it is confined to HiOS 14.0.0 handsets, and while no user interaction is needed to trigger the activity, the user must first be induced to install the attacker's app. |
| Impact | This is a CWE-862 missing-authorization flaw in the com.transsion.tranfacmode.entrance.main.MainActivity component of Transsion HiOS 14.0.0, where an unprotected exported Android activity lets any co-installed third-party app fire an intent that silently enables ADB debugging with no user interaction. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5) is INTERNALLY INCONSISTENT with the description: this is an on-device Android inter-app IPC issue requiring a malicious application already present on the handset, which is Local (AV:L), not Network (AV:N) - verify with vendor, as the corrected vector lowers the base score to roughly 4.2. No EPSS score, no CISA KEV listing, and no public POC were provided, and no SSVC decision data is supplied. Real-world risk is moderate-but-bounded: the true danger is not the direct C:L/I:L impact but that enabling ADB is a privilege-stepping-stone that broadens post-compromise capability for an app already on the device. Treat as a defense-in-depth hardening fix rather than an urgent internet-facing emergency. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app from a store or sideloaded APK on a Transsion (TECNO) HiOS 14.0.0 device. The app constructs an explicit intent targeting the unprotected MainActivity in com.transsion.tranfacmode and launches it, silently turning on ADB debugging without any prompt or user action. No public exploit code was provided in the intelligence set, but the technique is trivially reproducible given the missing permission declaration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Any third-party app already installed on a Transsion HiOS 14.0.0 handset can silently activate ADB debugging by sending an explicit Android intent to the exported, unprotected activity com.transsion.tranfacmode.entrance.main.MainActivity, with no user interaction and no prompt. Exploitation is local rather than remote - the attacker must first get a malicious or compromised application onto the device and running as an installed app, which is why our assessment rates the vector AV:L/AC:L/PR:N/UI:N and scores it 6.5 with limited confidentiality and integrity impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the underlying defect is missing authorization (CWE-862) on a system component that should never have been reachable from unprivileged third-party code.
RemediationAI
The primary remedy is a vendor firmware update for HiOS 14.0.0 from Transsion's security bulletin at https://security.tecno.com/SRC/securityUpdates (details at https://security.tecno.com/SRC/blogdetail/434?lang=en_US); note that no exact patched build number is identified in the available data, so verify with the OEM which OTA level carries the fix and confirm that com.transsion.tranfacmode.entrance.main.MainActivity is no longer exported without a permission after updating. Because exploitation depends on a hostile app already being installed, the most effective compensating control is shrinking the install surface: disable "install unknown apps" for browsers, messaging clients and file managers, keep Google Play Protect enabled, and avoid sideloading APKs from untrusted sources - the trade-off is friction for legitimate sideloading workflows. Enterprise or MDM-managed fleets can enforce Android Enterprise work-profile policies that block installation from unknown sources and restrict which apps may be present, which is stronger than user education but requires device management. On personally owned devices where factory mode is never needed, the tranfacmode package can be disabled for the current user (for example adb shell pm disable-user --user 0 com.transsion.tranfacmode), at the cost of breaking factory/test-mode diagnostics and possibly being reverted by an OTA. Finally, treat the ADB debugging state as untrusted: check Developer Options after any new app install and after updates, since the whole point of the flaw is to turn that toggle on without the owner noticing.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component lives in the Android system package com.transsion.tranfacmode, Transsion's factory/test-mode application pre-loaded on HiOS 14.0.0 (CPE cpe:2.3:o:transsion:hios:14.0.0:*:*:*:*:*:*:*). On Android, components such as activities are reachable from other applications only if they are exported and are not guarded by an android:permission declaration; here the activity com.transsion.tranfacmode.entrance.main.MainActivity is exported without any permission requirement, so any co-installed app can start it with an explicit intent and reach its privileged functionality. The root-cause class is CWE-862 Missing Authorization - the code performs the debugging-enable action without ever verifying that the caller is authorized - which turns a factory/diagnostic entry point into a silent switch for ADB (USB debugging). Because the caller is an ordinary app on the same device, no elevated privilege (PR:N) and no user gesture (UI:N) are needed once that app is present; note that the upstream NVD vector lists AV:N while our independent assessment treats the flaw as local (AV:L), since delivery of the triggering app inherently requires local code execution on the handset.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
On-device malicious app sends an intent, so AV:L not AV:N; no privileges or user interaction needed (PR:N/UI:N); enabling ADB yields limited direct confidentiality and integrity impact.
Primary rating from Vendor (907edf6c-bf03-423e-ab1a-8da27e1aa1ea).
CVSS VectorVendor: 907edf6c-bf03-423e-ab1a-8da27e1aa1ea
DescriptionCVE.org
The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party apps which can construct intents to directly open adb debugging functionality without user interaction.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
GitHub PoC
Exploit-DB