An improper authentication flaw in Motorola’s Factory Test component (com.motorola.motocit) allows a local threat actor to bypass device permission checks. By exploiting the reference to a writable file descriptor in external storage, a third‑party application on the device can open a TCP server that exposes sensitive permissions and data. The vulnerability effectively grants the attacker elevated access to protected device settings and related information without needing legitimate credential verification.

Motorola mobile phones that include the Factory Test component. No specific firmware version ranges are listed, so the issue applies to any device running software that contains the affected com.motorola.motocit implementation.

The CVSS score of 8.4 indicates a severe risk. EPSS data is not available, but the vulnerability is not listed in CISA KEV, suggesting no public exploit evidence yet. The only attack vector is local, requiring the attacker to have physical or regular user access to the device and the ability to install or run a third‑party app. Once executed, the attacker can establish a network service that leaks privileged information and can manipulate protected settings.