CVE-2025-50862: n/a
The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB backup on rooted or debug-enabled devices. This presents a risk of user data exposure.
AI Analysis
Technical Summary
CVE-2025-50862 identifies a vulnerability in the Lotus Cars Android app (com.lotus.carsdomestic.intl) version 1.2.8 where the Android manifest sets allowBackup=true. This configuration permits attackers with physical or debug access on rooted or debug-enabled devices to extract app data using Android Debug Bridge (ADB) backup functionality. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and has a CVSS 3.1 base score of 5.9, reflecting a medium severity impact on confidentiality, integrity, and availability.
Potential Impact
The vulnerability allows unauthorized data exfiltration from the affected app on rooted or debug-enabled devices via ADB backup. This can lead to exposure of sensitive user data stored by the app. There is no indication of known exploits in the wild. The impact affects confidentiality, integrity, and availability to a limited extent as per the CVSS vector.
Mitigation Recommendations
No official patch or fix has been published for this vulnerability as of the provided data. Users and administrators should avoid running the affected app version 1.2.8 on rooted or debug-enabled devices to mitigate risk. Monitoring vendor advisories for an official fix is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2025-50862: n/a
Description
The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB backup on rooted or debug-enabled devices. This presents a risk of user data exposure.
CVSS v3.1
Score 5.9medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-50862 identifies a vulnerability in the Lotus Cars Android app (com.lotus.carsdomestic.intl) version 1.2.8 where the Android manifest sets allowBackup=true. This configuration permits attackers with physical or debug access on rooted or debug-enabled devices to extract app data using Android Debug Bridge (ADB) backup functionality. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and has a CVSS 3.1 base score of 5.9, reflecting a medium severity impact on confidentiality, integrity, and availability.
Potential Impact
The vulnerability allows unauthorized data exfiltration from the affected app on rooted or debug-enabled devices via ADB backup. This can lead to exposure of sensitive user data stored by the app. There is no indication of known exploits in the wild. The impact affects confidentiality, integrity, and availability to a limited extent as per the CVSS vector.
Mitigation Recommendations
No official patch or fix has been published for this vulnerability as of the provided data. Users and administrators should avoid running the affected app version 1.2.8 on rooted or debug-enabled devices to mitigate risk. Monitoring vendor advisories for an official fix is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- mitre
- Date Reserved
- 2025-06-16T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 689e446ead5a09ad005e52c8
Added to database: 08/14/2025, 20:17:50 UTC
Last enriched: 07/05/2026, 21:19:13 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 200
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.