CVE-2024-12603 - Vulnerability Details - OpenCVE

A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00255.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://security.tecno.com/SRC/blogdetail/356?lang=en_US
https://security.tecno.com/SRC/securityUpdates

History

Fri, 05 Sep 2025 07:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-287

Fri, 05 Sep 2025 06:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-602

Fri, 14 Mar 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Mon, 16 Dec 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 13 Dec 2024 03:15:00 +0000

Type	Values Removed	Values Added
Description		A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.
Weaknesses		CWE-287
References		https://security.tecno.com/SRC/blogdetail/356?lang=en_US https://security.tecno.com/SRC/securityUpdates

MITRE

Status: PUBLISHED

Assigner: TECNOMobile

Published: 2024-12-13T02:54:44.277Z

Updated: 2025-09-05T06:31:04.528Z

Reserved: 2024-12-13T02:21:51.064Z

Link: CVE-2024-12603

Vulnrichment

Updated: 2024-12-16T18:18:48.260Z

NVD

Status : Awaiting Analysis

Published: 2024-12-13T03:15:05.187

Modified: 2025-09-05T07:15:33.223

Link: CVE-2024-12603

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-12603", "assignerOrgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "state": "PUBLISHED", "assignerShortName": "TECNOMobile", "dateReserved": "2024-12-13T02:21:51.064Z", "datePublished": "2024-12-13T02:54:44.277Z", "dateUpdated": "2025-09-05T06:31:04.528Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "com.transsion.applock", "vendor": "TECNO", "versions": [{"lessThanOrEqual": "\uff1c1.1.2.292", "status": "affected", "version": "1.1.2.269", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div>A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.</div></div>\n\n<br>"}], "value": "A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "shortName": "TECNOMobile", "dateUpdated": "2025-09-05T06:31:04.528Z"}, "references": [{"url": "https://security.tecno.com/SRC/securityUpdates"}, {"url": "https://security.tecno.com/SRC/blogdetail/356?lang=en_US"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-16T18:18:38.098926Z", "id": "CVE-2024-12603", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T16:12:26.249Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-12603", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-16T18:18:38.098926Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-16T18:18:48.260Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"vendor": "TECNO", "product": "com.transsion.applock", "versions": [{"status": "affected", "version": "1.1.2.269", "versionType": "custom", "lessThanOrEqual": "\uff1c1.1.2.292"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://security.tecno.com/SRC/securityUpdates"}, {"url": "https://security.tecno.com/SRC/blogdetail/356?lang=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.", "supportingMedia": [{"type": "text/html", "value": "<div><div>A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.</div></div>\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security"}]}], "providerMetadata": {"orgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "shortName": "TECNOMobile", "dateUpdated": "2025-09-05T06:31:04.528Z"}}}, "cveMetadata": {"cveId": "CVE-2024-12603", "state": "PUBLISHED", "dateUpdated": "2025-09-05T06:31:04.528Z", "dateReserved": "2024-12-13T02:21:51.064Z", "assignerOrgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "datePublished": "2024-12-13T02:54:44.277Z", "assignerShortName": "TECNOMobile"}, "dataVersion": "5.1"}