CVE-2025-50862
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Lotus Cars Android app (com.lotus.carsdomestic.intl) version 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB backup on rooted or debug-enabled devices. This poses a risk of user data exposure.
Risk Assessment
The organization risks leakage of sensitive user data, such as login credentials or vehicle information, if the device is compromised or has debugging enabled.
Recommendation
Set allowBackup=false in the AndroidManifest.xml file and release an updated version to prevent ADB backups.
Original NVD description (English source)
The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB backup on rooted or debug-enabled devices. This presents a risk of user data exposure.