The vulnerability resides in the FeatureActionActivity component of Oasis Feng Island. It arises from insecure permission enforcement, enabling unauthenticated users to invoke a device “freeze” operation. This action blocks the operating system’s normal operation, effectively rendering the device unusable until it is rebooted or the freeze state is cleared. The impact is a clear Denial of Service that compromises availability for the affected device.

Oasis Feng Island (versionCode 51801). No other vendors or products are listed as affected, and the advisory does not specify additional versions.

The CVSS score is not provided, but given that the flaw allows any unauthenticated attacker to force a freeze, the risk is high. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or through a compromised app installation, as the issuer notes that it can be triggered by an “unauthorized attacker.”