CVE-2025-5346
Last modified
CVE-2025-5346 is a medium-severity vulnerability rated 5.1/10 on the CVSS scale. Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver "kr.co.bluebird.android.bbsettings.BootReceiver". EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver "kr.co.bluebird.android.bbsettings.BootReceiver". A local attacker can call the receiver to overwrite file containing ".json" keyword with default barcode config file. It is possible to overwrite file in any location due to lack of protection against path traversal in name of the file. This issue affects all versions before 1.3.3.
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-5346?
How severe is CVE-2025-5346?
How do I fix CVE-2025-5346?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-53454Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-53455Improper Neutralization of Input During Web Page Generation …5.9
- CVE-2025-53456Cross-Site Request Forgery (CSRF) vulnerability in activeweb…4.3
- CVE-2025-53457Server-Side Request Forgery (SSRF) vulnerability in activewe…4.4
- CVE-2025-53458Improper Neutralization of Input During Web Page Generation …5.9
- CVE-2025-53459Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2025-53460Improper Neutralization of Input During Web Page Generation …5.9
- CVE-2025-53461Server-Side Request Forgery (SSRF) vulnerability in Binsaifu…4.4
- CVE-2025-53462Improper Neutralization of Input During Web Page Generation …5.9
- CVE-2025-53463Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-53464Improper Neutralization of Input During Web Page Generation …5.9
- CVE-2025-53465Deserialization of Untrusted Data vulnerability in raoinfote…7.2
Are you affected by CVE-2025-5346?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST