Easyelife App Lock CVE-2025-68710
LOWSeverity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome), resulting in information disclosure and privilege escalation.
AnalysisAI
PIN lock bypass in Easyelife App Lock 1.9.2 for Android allows a local attacker with physical device access to reach applications that were supposedly secured behind a PIN. The root cause is architectural: the lock is implemented as a UI overlay rather than through Android's native secure authentication APIs (BiometricPrompt, KeyguardManager), meaning it can be circumvented by triggering advertisement or browser intents that cause the app to navigate cascading activity flows, effectively routing around the overlay. EPSS is very low at 0.05% (16th percentile), no public exploit is confirmed in CISA KEV, and a researcher disclosure with likely proof-of-concept steps is publicly available on GitHub.
Technical ContextAI
CWE-288 (Authentication Bypass Using an Alternate Path or Channel) describes the root cause precisely: the application establishes a security boundary via an Android overlay window rendered atop other apps, rather than integrating Android's privileged authentication subsystem. Android overlays are application-layer constructs and do not gate Activity launching or intent resolution at the OS level. When the app processes certain implicit intents - such as those fired by in-app advertisements or deep links from a browser - Android's activity manager can launch or surface underlying protected apps, bypassing the overlay entirely. Secure alternatives such as KeyguardManager.createConfirmDeviceCredentialIntent() or BiometricPrompt enforce authentication at the framework level and are not susceptible to this routing attack. The CPE string provided (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is a placeholder and reflects the app's lack of formal NVD product registration; the canonical Android package identifier is locker.app.safe.applocker.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary recommended action is to uninstall Easyelife App Lock (locker.app.safe.applocker) and cease relying on it as a security control. As a compensating control, users requiring application-level access protection should instead configure Android's built-in screen lock (PIN, pattern, or biometric) via device Settings, which enforces authentication at the OS level and is not bypassable through intent routing. For enterprise deployments requiring per-app authentication controls, evaluate Mobile Device Management (MDM) solutions or Android Work Profile configurations that leverage Android's official KeyguardManager and BiometricPrompt APIs. Researcher disclosure is available at https://github.com/actuator/locker.app.safe.applocker/blob/main/CVE-2025-68710. Note that switching to native Android screen lock will require the device to be unlocked at the OS level rather than per-app, which is a behavioral trade-off users should evaluate against their threat model.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today