CVE-2025-57197

{
  "id": "CVE-2025-57197",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-29T18:15:32.957",
  "lastModified": "2026-11-07T17:10:00.240",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacker with root access to the device can dynamically instrument the app to bypass the current PIN verification check and directly modify the authentication PIN. This allows unauthorized users to change PIN without knowing the original/current PIN."
    },
    {
      "lang": "es",
      "value": "En la aplicación Payeer para Android 2.5.0, existe una vulnerabilidad de control de acceso inadecuado en el flujo de autenticación para la función de cambio de PIN. Un atacante local con acceso root al dispositivo puede instrumentar dinámicamente la aplicación para eludir la verificación del PIN actual y modificar directamente el PIN de autenticación. Esto permite a usuarios no autorizados cambiar el PIN sin conocer el PIN original/actual."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-30T17:23:13.367552Z",
          "id": "CVE-2025-57197",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://drive.google.com/drive/folders/1FHn4dFHeJ6W1IKlsB447v_hJoqqF9qgv?usp=sharing",
      "source": "[email protected]"
    },
    {
      "url": "https://medium.com/@mhamdanali81/cve-2025-57197-breaking-the-pin-in-payeers-android-app-31e3cdee02ef",
      "source": "[email protected]"
    },
    {
      "url": "https://payeer.com",
      "source": "[email protected]"
    }
  ]
}