Audiolink
Monthly
Unauthorized invocation of the AudioLink service on Tecno devices running version 1.3.0.87 lets a local attacker overwrite system files, an Incorrect Authorization flaw (CWE-863) in a service that is exposed without any permission or authorization check. Exploitation requires prior local code execution on the affected device - a co-resident malicious application or a local shell capable of reaching the AudioLink service - and is rated moderate severity (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, integrity impact only, no confidentiality or availability loss, no RCE on its own). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is only 0.21% (11th percentile), indicating low near-term exploitation likelihood, and the vendor's published advisory page is the only reference provided.
Unauthorized invocation of the AudioLink service on Tecno devices running version 1.3.0.87 lets a local attacker overwrite system files, an Incorrect Authorization flaw (CWE-863) in a service that is exposed without any permission or authorization check. Exploitation requires prior local code execution on the affected device - a co-resident malicious application or a local shell capable of reaching the AudioLink service - and is rated moderate severity (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, integrity impact only, no confidentiality or availability loss, no RCE on its own). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is only 0.21% (11th percentile), indicating low near-term exploitation likelihood, and the vendor's published advisory page is the only reference provided.