CVE-2025-14817 Factory Mode App Exists Privilege Escalation Issue Allowing Third-Party Apps to Open ADB
Third-party apps can bypass permissions to enable ADB debugging on Tecno devices, allowing unauthorized access and potential privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14817?
CVE-2025-14817 is a medium-severity missing authorization vulnerability in Tecno Pova6 Pro 5G, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party apps which can construct intents to directly open adb debugging functionality without user interaction.
Weakness: CWE-862
Which versions are affected by CVE-2025-14817?
It affects 1 product.
Products include Transsion Hios.
How do I fix CVE-2025-14817?
No fix has been published for CVE-2025-14817 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-14817 being exploited?
There is no known exploitation of CVE-2025-14817 in the wild and no public exploit code.
Sources
Also known as GHSA-q4hg-gxj2-4c9q.