CVE-2025-50861 affects the Lotus Cars Android app (com.lotus.carsdomestic.intl) version 1.2.8. The vulnerability arises from an exported component, PushDeepLinkActivity, which does not require authentication and can be accessed remotely via ADB or by malicious applications. This improper access control can result in unintended interactions with the app's internals, leading to denial of service conditions or abuse of application logic. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, with limited confidentiality impact and low availability impact.

An attacker or malicious app can invoke the exported PushDeepLinkActivity component without authentication, potentially causing denial of service or manipulation of application logic. Confidentiality impact is limited, and integrity is not affected according to the CVSS vector. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict access to the device via ADB and avoid installing untrusted applications to reduce risk.