KukuFM Android CVE-2025-25758: Data Disclosure via Insecure allowBackup Configuration

Critical Vulnerability Information Vulnerability ID CVE-2025-25758 Publication Status Published Description A vulnerability exists in KukuFM Android v1.12.7 (11207) due to the declaration of in the AndroidManifest.xml file. This configuration allows attackers with physical access to the device to extract sensitive plaintext information using the Android Debug Bridge (ADB) backup functionality. Exploiting this vulnerability does not require root access and may lead to disclosure of internal application data, such as shared preferences, configuration files, and local databases containing plaintext data. Impact Unauthorized access to sensitive application data Exposure of user credentials or authentication tokens Violation of user privacy and data protection standards Potential misuse of personal information or application-specific data Compromise of application security posture Attack Scenario Attacker gains physical access to the Android device Enables USB debugging Connects the device to a computer via ADB Executes Extracts backup data from the KukuFM app, including: , , and other internal configuration files Technical Details Vulnerability Type: Incorrect Access Control CWE Classification: CWE-732 (Improper Permission Assignment for Critical Resource) Attack Type: Local Affected Version: 1.12.7 (11207) Affected Component: AndroidManifest.xml ( ) Impact: Information Disclosure Affected Product: KukuFM Android Application Remediation Recommendations Set to to prevent unauthorized ADB backups Encrypt sensitive data stored in shared_prefs and databases Use Android Keystore to securely store authentication tokens and credentials Regularly audit AndroidManifest configuration to detect insecure flags Apply best practices to ensure secure local data storage and access control

Goal Reached Thanks to every supporter — we hit 100%!

KukuFM Android CVE-2025-25758: Data Disclosure via Insecure allowBackup Configuration