CVE-2026-13514

{"id": "CVE-2026-13514", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13514", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T13:40:29.246622Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 0.9, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:chess:play_and_learn_app:*:*:*:*:*:*:*:*"], "vendor": "Chess", "modules": ["com.chess"], "product": "Play and Learn App", "versions": [{"status": "affected", "version": "4.9.0"}, {"status": "affected", "version": "4.9.1"}, {"status": "affected", "version": "4.9.2"}, {"status": "affected", "version": "4.9.3"}, {"status": "affected", "version": "4.9.4"}, {"status": "affected", "version": "4.9.5"}, {"status": "affected", "version": "4.9.6"}, {"status": "affected", "version": "4.9.7"}, {"status": "affected", "version": "4.9.8"}, {"status": "affected", "version": "4.9.9"}, {"status": "affected", "version": "4.9.10"}, {"status": "affected", "version": "4.9.11"}, {"status": "affected", "version": "4.9.12"}, {"status": "affected", "version": "4.9.13"}, {"status": "affected", "version": "4.9.14"}, {"status": "affected", "version": "4.9.15"}, {"status": "affected", "version": "4.9.16"}, {"status": "affected", "version": "4.9.17"}, {"status": "affected", "version": "4.9.18"}, {"status": "affected", "version": "4.9.19"}, {"status": "affected", "version": "4.9.20"}, {"status": "affected", "version": "4.9.21"}, {"status": "affected", "version": "4.9.22"}, {"status": "affected", "version": "4.9.23"}, {"status": "affected", "version": "4.9.24"}, {"status": "affected", "version": "4.9.25"}, {"status": "affected", "version": "4.9.26"}, {"status": "affected", "version": "4.9.27"}, {"status": "affected", "version": "4.9.28"}, {"status": "affected", "version": "4.9.29"}, {"status": "affected", "version": "4.9.30"}, {"status": "affected", "version": "4.9.31"}, {"status": "affected", "version": "4.9.32"}, {"status": "affected", "version": "4.9.33"}, {"status": "affected", "version": "4.9.34"}, {"status": "affected", "version": "4.9.35"}, {"status": "affected", "version": "4.9.36"}, {"status": "affected", "version": "4.9.37"}, {"status": "affected", "version": "4.9.38"}, {"status": "affected", "version": "4.9.39"}, {"status": "affected", "version": "4.9.40"}, {"status": "affected", "version": "4.9.41"}, {"status": "affected", "version": "4.9.42"}]}]}], "published": "2026-06-29T00:16:47.280", "references": [{"url": "https://github.com/honestcorrupt/CHESS.COM-CVE-REQUEST", "source": "cna@vuldb.com"}, {"url": "https://play.google.com/store/apps/details?id=com.chess", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-13514", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/838880", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/374522", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/374522/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-530"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. Upgrading the affected component is advised. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty \"explicitly excludes physical-access attacks\". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher."}, {"lang": "es", "value": "Se ha identificado una debilidad en la aplicaci\u00f3n Chess Play and Learn hasta la versi\u00f3n 4.9.42 en Android. Este problema afecta a alg\u00fan procesamiento desconocido del archivo AndroidManifest.xml del componente com.chess. Esta manipulaci\u00f3n causa la exposici\u00f3n del archivo de copia de seguridad a una esfera de control no autorizada. Es factible realizar el ataque en el dispositivo f\u00edsico. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda usarse para ataques. Se aconseja actualizar el componente afectado. El proveedor fue informado con antelaci\u00f3n sobre este problema. Confirmaron la existencia y que lo abordar\u00e1n. Adem\u00e1s, explican que su programa de recompensas por errores \u2019excluye expl\u00edcitamente los ataques de acceso f\u00edsico\u2019. Sin embargo, aprecian la calidad del informe y tienen como objetivo realizar un pago de buena voluntad al investigador."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "cna@vuldb.com"}