Motorola Factory Test CVE-2026-5804

Exploitation requires the attacker to already be running code on the targeted Motorola phone as a low-privileged third-party Android app (CVSS AV:L, PR:L) - typically delivered via a sideloaded APK or a malicious app on an app store - and the vulnerable build of the Motorola Factory Test component com.motorola.motocit (pre-2026-04-05 patch) must be present and active on the device. No user interaction is needed after the malicious app is installed (UI:N), and no additional attack prerequisites are required (AT:N), but exploitation is bounded to the local device: there is no network-reachable attack surface, the issue does not work against handsets from other OEMs, and devices that have already received the April 2026 Motorola security update are not exploitable.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N is internally consistent with the description: an already-installed low-privileged app on the handset gains high confidentiality and integrity over protected device data, with no availability impact and no scope change beyond the vulnerable system. With patch availability confirmed by the vendor and the attack requiring code already running on the device (typically via a malicious sideloaded or Play Store app), this is a meaningful privilege-boundary break but not a remote, wormable issue. No EPSS or SSVC data was supplied, no POC was published, and the vulnerability is not in CISA KEV - so real-world exploitation is plausible but unproven, and prioritization should track Motorola's OTA rollout for the affected fleet rather than emergency response.

A user installs an attacker-controlled Android app (e.g., from a third-party store or a malicious Play listing) that requests only ordinary permissions. Once running, the app reaches the leaked writable file descriptor exposed by com.motorola.motocit, opens a local TCP server inheriting the factory-test app's privileges, and uses it to read protected device settings and identifiers that the app itself would normally be denied. No public exploit identified at time of analysis.