VulnerabilityDeferred

CVE-2025-50861

The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps.

MEDIUM 6.5EPSS 0.33%

Does this matter?

Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.

Description

The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps. This poses a risk of unintended access to application internals and can cause denial of service or logic abuse.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
EPSS: 0.33% probability · 26th percentile
CISA KEV: Not listed
Weakness: CWE-284, CWE-400
Source: cve@mitre.org

References

https://github.com/JackSessions/Jack-Sessions-CVEs/tree/main

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.