Easyelife App Lock CVE-2025-68710
LOWCVSS VectorNVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionNVD
Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome), resulting in information disclosure and privilege escalation.
AnalysisAI
PIN lock bypass in Easyelife App Lock 1.9.2 for Android allows a local attacker with physical device access to reach applications that were supposedly secured behind a PIN. The root cause is architectural: the lock is implemented as a UI overlay rather than through Android's native secure authentication APIs (BiometricPrompt, KeyguardManager), meaning it can be circumvented by triggering advertisement or browser intents that cause the app to navigate cascading activity flows, effectively routing around the overlay. EPSS is very low at 0.05% (16th percentile), no public exploit is confirmed in CISA KEV, and a researcher disclosure with likely proof-of-concept steps is publicly available on GitHub.
Technical ContextAI
CWE-288 (Authentication Bypass Using an Alternate Path or Channel) describes the root cause precisely: the application establishes a security boundary via an Android overlay window rendered atop other apps, rather than integrating Android's privileged authentication subsystem. Android overlays are application-layer constructs and do not gate Activity launching or intent resolution at the OS level. When the app processes certain implicit intents - such as those fired by in-app advertisements or deep links from a browser - Android's activity manager can launch or surface underlying protected apps, bypassing the overlay entirely. Secure alternatives such as KeyguardManager.createConfirmDeviceCredentialIntent() or BiometricPrompt enforce authentication at the framework level and are not susceptible to this routing attack. The CPE string provided (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is a placeholder and reflects the app's lack of formal NVD product registration; the canonical Android package identifier is locker.app.safe.applocker.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary recommended action is to uninstall Easyelife App Lock (locker.app.safe.applocker) and cease relying on it as a security control. As a compensating control, users requiring application-level access protection should instead configure Android's built-in screen lock (PIN, pattern, or biometric) via device Settings, which enforces authentication at the OS level and is not bypassable through intent routing. For enterprise deployments requiring per-app authentication controls, evaluate Mobile Device Management (MDM) solutions or Android Work Profile configurations that leverage Android's official KeyguardManager and BiometricPrompt APIs. Researcher disclosure is available at https://github.com/actuator/locker.app.safe.applocker/blob/main/CVE-2025-68710. Note that switching to native Android screen lock will require the device to be unlocked at the OS level rather than per-app, which is a behavioral trade-off users should evaluate against their threat model.
More from same product – last 7 days
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Stored Cross-Site Scripting in the Google+ Link Name WordPress plugin (versions up to and including 1.0) allows authenti
Authentication bypass in SpSoft AppLock 7.9.40 for Android allows a local attacker with physical device access to circum
Authorization bypass in the Geo Mashup WordPress plugin (all versions ≤ 1.13.19) exposes sensitive plugin configuration
Arbitrary JavaScript execution in SailingLab AppLock 4.3.8 for Android is triggered by a malicious co-installed app send
Share
External POC / Exploit Code
Leaving vuln.today