{"id":"CVE-2025-27389","state":"PUBLISHED","title":"Application Installation Source Verification Flaw May Lead to Risk Detection Bypass","description":"A flaw exists in the verification of application installation sources within ColorOS. Under specific conditions, this issue may cause the risk detection mechanism to fail, which could allow malicious applications to be installed without proper warning.","publishedAt":"2025-12-05T03:19:49.490Z","updatedAt":"2025-12-05T16:20:31.736Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","source":"OPPO"},"assigner":"OPPO","products":["ColorOS ColorOS"],"affected":[{"vendor":"ColorOS","product":"ColorOS","defaultStatus":"unaffected","versions":[{"version":"ColorOS 11–15","status":"affected"}]}],"references":["https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1996493715665068032"],"weaknesses":["CWE-290"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/27xxx/CVE-2025-27389.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-27389","state":"PUBLISHED","datePublished":"2025-12-05T03:19:49.490Z","dateUpdated":"2025-12-05T16:20:31.736Z","assignerShortName":"OPPO","assignerOrgId":"7f2b1ad8-5432-4d64-91a1-9099af1cc695","dateReserved":"2025-02-24T03:04:32.845Z"},"containers":{"cna":{"title":"Application Installation Source Verification Flaw May Lead to Risk Detection Bypass","descriptions":[{"lang":"en","value":"A flaw exists in the verification of application installation sources within ColorOS. Under specific conditions, this issue may cause the risk detection mechanism to fail, which could allow malicious applications to be installed without proper warning."}],"affected":[{"vendor":"ColorOS","product":"ColorOS","defaultStatus":"unaffected","versions":[{"version":"ColorOS 11–15","status":"affected"}]}],"references":[{"url":"https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1996493715665068032"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":5.1,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-290","description":"CWE-290 Authentication Bypass by Spoofing","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"OPPO","orgId":"7f2b1ad8-5432-4d64-91a1-9099af1cc695","dateUpdated":"2025-12-05T03:19:49.490Z"},"datePublic":"2025-12-04T08:17:00.000Z","impacts":[{"capecId":"CAPEC-151","descriptions":[{"lang":"en","value":"CAPEC-151 Identity Spoofing"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-05T16:20:11.207457Z","id":"CVE-2025-27389","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-05T16:20:31.736Z"}}]}}}