A flaw in the FakeAppService function of Freedom Factory dGEN1’s org.ethosmobile.ethoslauncher component leads to improper authorization. The local attacker gains unauthorized access to functionality normally protected, potentially allowing privilege escalation or unauthorized data disclosure. The vulnerability is characterized by the weaknesses identified in CWE-266 (Improper Privilege Allocation) and CWE-285 (Improper Authorization). The exploit code is publicly available and can be used by anyone with local device access.

Freedom Factory dGEN1 is affected in all releases up to 20260221. No specific sub‑models or firmware revisions beyond that timestamp are listed, so any device running the specified firmware or earlier should be considered vulnerable.

The CVSS score of 4.8 indicates a moderate risk, while the EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. Because the attack vector is local, an adversary must first obtain access to the device, either as a physical user or via another local exploit. Once local access is established, the attacker can invoke the FakeAppService API to bypass authorization checks and gain elevated privileges or access restricted data.