CVE-2025-27389

A flaw exists in the verification of application installation sources within ColorOS. Under specific conditions, this issue may cause the risk detection mechanism to fail, which could allow malicious applications to be installed without proper warning.

CVSS

No CVSS.

References

Link	Resource
https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1996493715665068032

Configurations

No configuration.

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Un fallo existe en la verificación de las fuentes de instalación de aplicaciones dentro de ColorOS. Bajo condiciones específicas, este problema puede causar que el mecanismo de detección de riesgo falle, lo que podría permitir que se instalen aplicaciones maliciosas sin la advertencia adecuada.

Information

Published : 2025-12-05 04:16

Updated : 2026-09-25 23:10

NVD link : CVE-2025-27389

Mitre link : CVE-2025-27389

CVE.ORG link : CVE-2025-27389

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2025-27389", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27389", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T16:20:11.207457Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@oppo.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@oppo.com", "affectedData": [{"vendor": "ColorOS", "product": "ColorOS", "versions": [{"status": "affected", "version": "ColorOS 11\u201315"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-05T04:16:00.333", "references": [{"url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1996493715665068032", "source": "security@oppo.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@oppo.com", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "A flaw exists in the verification of application installation sources within ColorOS. Under specific conditions, this issue may cause the risk detection mechanism to fail, which could allow malicious applications to be installed without proper warning."}, {"lang": "es", "value": "Un fallo existe en la verificaci\u00f3n de las fuentes de instalaci\u00f3n de aplicaciones dentro de ColorOS. Bajo condiciones espec\u00edficas, este problema puede causar que el mecanismo de detecci\u00f3n de riesgo falle, lo que podr\u00eda permitir que se instalen aplicaciones maliciosas sin la advertencia adecuada."}], "lastModified": "2026-09-25T23:10:00.463", "sourceIdentifier": "security@oppo.com"}