EUVD-2025-18369
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation.
Analysis
Critical permission vulnerability in the BoomPlayer mobile application (com.afmobi.boomplayer) that allows unauthenticated remote attackers to perform unauthorized operations with complete compromise of confidentiality, integrity, and availability. The vulnerability carries a maximum CVSS score of 9.8 and is classified as an improper authentication/authorization defect (CWE-287); exploitation requires no user interaction and can be triggered over the network, making it a severe risk to all users of this application.
Technical Context
The vulnerability resides in the BoomPlayer Android application (package identifier: com.afmobi.boomplayer) and involves improper permission handling or missing authentication checks (CWE-287: Improper Authentication). This class of vulnerability typically manifests when the application fails to properly validate user identity or enforce role-based access controls before exposing sensitive operations. The root cause likely involves: (1) missing or inadequate permission declarations in the Android manifest, (2) unprotected exported components (Activities, Services, Broadcast Receivers, or Content Providers), or (3) insufficient runtime permission validation. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms the vulnerability is network-accessible with low attack complexity, requiring no privileges or user interaction, and maintains the same privilege scope before and after exploitation. This suggests either a completely unauthenticated API endpoint or an exported Android component accessible to any installed application or remote caller.
Affected Products
BoomPlayer (All versions prior to patch release (specific patched version not provided in CVE data))
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today