The vulnerability allows an attacker with local access to manipulate the FakeAppReceiver component within org.ethosmobile.ethoslauncher, enabling unauthorized operations due to improper authorization. It is classified as CWE‑266 (Improper Permission Assignment) and CWE‑285 (Authorization Bypass via Privilege Escalation). This flaw could compromise the integrity of device configuration or allow execution of privileged actions that should be restricted. The impact is limited to what the attacker can perform within the device’s local context, potentially exposing sensitive settings or enabling further local exploitation.

Freedom Factory dGEN1 firmware up to the release dated 20260221 contains the vulnerable org.ethosmobile.ethoslauncher component. No official patch or update has been released, and the vendor has not responded to the disclosure.

The CVSS base score of 4.8 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw requires local attack and has been publicly disclosed, but is not listed in the CISA KEV catalog. In environments where local physical or network access is possible, the risk remains moderate; however, the exploitation probability is low and no actively leveraged attacks are known.