CVE-2024-13917 Overview
CVE-2024-13917 is an intent redirection vulnerability in the com.pri.applock application pre-loaded on Kruger&Matz Android smartphones. The AppLock application encrypts user-selected apps behind a PIN code or biometric authentication. The exposed com.pri.applock.LockUI activity permits any installed malicious application, without holding Android system permissions, to inject arbitrary intents into protected applications with system-level privileges.
Exploitation requires knowledge of the AppLock PIN, which may be obtained through CVE-2024-13916 or through user interaction. The issue was confirmed on version name 13, version code 33. An application update addressing the flaw was released in April 2025.
Critical Impact
A local, unprivileged Android application can escalate privileges by injecting intents into protected apps with system-level context, exposing sensitive user data and functionality.
Affected Products
- Kruger&Matz smartphones with pre-loaded com.pri.applock
- com.pri.applock version name 13, version code 33
- Devices without the April 2025 application update
Discovery Timeline
- 2025-05-30 - CVE-2024-13917 published to NVD
- April 2025 - Vendor released application update addressing the vulnerability
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13917
Vulnerability Analysis
The com.pri.applock application acts as a system-privileged gatekeeper for other apps installed on Kruger&Matz devices. It enforces access control by displaying a PIN or biometric prompt through the com.pri.applock.LockUI activity before allowing a protected application to launch.
The LockUI activity is exported and accessible to any third-party application on the device. A caller can pass an arbitrary intent as an extra, and once the PIN check succeeds, LockUI forwards that intent to the target protected application. Because AppLock runs with elevated system-level privileges, the forwarded intent inherits that context. This maps to [CWE-926: Improper Export of Android Application Components].
The vulnerability is classified as Intent Redirection and falls under mobile application weaknesses tied to inter-process communication (IPC) misuse on Android.
Root Cause
The root cause is the improper export of the LockUI activity combined with missing validation of the intent payload it forwards. LockUI treats caller-supplied intents as trusted after the PIN check, rather than restricting the destination component, action, or extras. The system-level privilege of the AppLock process amplifies the impact of the redirection.
Attack Vector
An attacker installs a malicious application on the target device. That application requires no Android permissions. The malicious app constructs an intent targeting com.pri.applock.LockUI and embeds a secondary intent aimed at a protected application. The attacker must supply the correct AppLock PIN, either obtained through CVE-2024-13916 or by prompting the user directly. LockUI then delivers the crafted intent to the protected application with system-level privileges.
The vulnerability manifests through Android IPC. See the CERT Poland CVE-2024-13915 Analysis for technical details on the related pre-loaded application weaknesses on Kruger&Matz devices.
Detection Methods for CVE-2024-13917
Indicators of Compromise
- Unexpected invocations of com.pri.applock.LockUI from non-system caller packages
- Third-party applications constructing intents that target com.pri.applock components
- Protected applications receiving intents originating from unrelated user-installed apps
Detection Strategies
- Inspect installed application manifests for explicit references to com.pri.applock.LockUI in intent targets
- Monitor Android IPC telemetry on managed devices for cross-app intent forwarding involving system-privileged AppLock components
- Use mobile threat defense tooling to flag apps that repeatedly launch LockUI with embedded secondary intents
Monitoring Recommendations
- Track the installed version of com.pri.applock across the mobile fleet and identify devices still running version code 33
- Alert on installation of unknown or side-loaded APKs on affected Kruger&Matz device models
- Correlate AppLock unlock events with recent third-party application launches
How to Mitigate CVE-2024-13917
Immediate Actions Required
- Update com.pri.applock to the release published in April 2025 or later
- Inventory Kruger&Matz devices and confirm none remain on version name 13, version code 33
- Instruct users not to disclose the AppLock PIN to prompts from other applications
Patch Information
Kruger&Matz released an application update for com.pri.applock in April 2025 that addresses the exported LockUI activity issue. Devices should install the current version through the vendor's update channel. Refer to the CERT Poland advisory for coordinated disclosure details covering the related CVEs in the same pre-loaded application family.
Workarounds
- Restrict installation of third-party or side-loaded applications on affected devices
- Disable or uninstall com.pri.applock where the AppLock functionality is not required
- Rotate the AppLock PIN if there is any suspicion it was disclosed, particularly if CVE-2024-13916 may have been exploited
# Verify installed AppLock version on an affected device via ADB
adb shell dumpsys package com.pri.applock | grep -E "versionName|versionCode"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
