CVE-2025-0590

CVE-2025-0590 involves improper permission settings in the com.transsion.carlcare mobile application, which may lead to an information leakage risk. This vulnerability, published on 2025-01-20, is linked to CWE-732 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no effects on integrity or availability.

The vulnerability can be exploited by a remote, unauthenticated attacker over the network with low attack complexity and no user interaction required. Successful exploitation allows the attacker to access sensitive information stored or handled by the affected application, resulting in unauthorized data disclosure.

Mitigation details are available in advisories from the Tecno Security Response Center, including the specific blog post at https://security.tecno.com/SRC/blogdetail/381?lang=en_US and the security updates page at https://security.tecno.com/SRC/securityUpdates.