CVE-2025-50861
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The Lotus Cars Android app (version 1.2.8) exposes the PushDeepLinkActivity component without authentication, accessible via ADB or malicious apps. This allows unauthorized access to internal app mechanisms, potentially leading to denial of service or logic abuse.
Risk Assessment
The risk includes remote triggering of app crashes (DoS) or manipulation of its behavior by an unauthenticated attacker, which may impact vehicle-related functionality and user trust.
Recommendation
Immediately update the app to the latest patched version and restrict component exports in AndroidManifest.xml.
Original NVD description (English source)
The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps. This poses a risk of unintended access to application internals and can cause denial of service or logic abuse.