The FakeAppProvider function in org.ethosmobile.ethoslauncher allows local manipulation that bypasses authorization checks, giving a local user access to actions that should require higher privileges. This improper authorization can lead to unintended operation execution or data access that the attacker is not entitled to. The weakness corresponds to common authorization flaws defined in CWE‑266 and CWE‑285.

The vulnerability affects Freedom Factory dGEN1 devices running firmware versions up to 20260221. No other versions or products are listed as affected. The issue resides in the org.ethosmobile.ethoslauncher component of the device’s operating environment.

CVSS scores of 4.8 mark the issue as moderate in severity, while an EPSS of less than 1% indicates that real‑world exploitation is currently expected to be rare. Because the attack requires local access and no public exploit has yet been documented beyond the disclosed manipulation, the immediate risk is low, but the vendor has not released a fix and has not responded to notification. The vulnerability’s presence in the system is therefore a potential risk for anyone who can log into the device locally, and mitigation steps should be taken even in the absence of an official patch.