This vulnerability in Motorola phones' Factory Test component arises from missing authentication controls on a critical function. The component references a writable file descriptor in external storage, allowing local third-party applications to open a TCP server. This unauthorized access bypasses permission checks, potentially exposing sensitive permissions and device settings. The CVSS 4.0 vector indicates the attack requires local access with low complexity and privileges but results in high confidentiality and integrity impact. The vulnerability was published on May 19, 2026, with no vendor remediation level or patch information available at this time.

A local attacker with limited privileges can exploit this vulnerability to bypass permission checks and access protected device settings and sensitive permissions. This could lead to unauthorized disclosure or modification of critical device configurations. The CVSS score of 8.4 reflects a high impact on confidentiality and integrity, though exploitation requires local access and some privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict installation of untrusted local applications and limit physical or local access to the device to reduce risk.