p PatchFirst

CVE-2025-24805

CVE-2025-24805 · Local Privilege Escalation in MobSF

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 8.5 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • mobile-security-framework-mobsf

    Versions
    • = 4.3.0: Affected

    No fix published

  • mobsf PyPI

    Versions
    • 3.2.6
    • 3.2.7
    • 3.2.8
    • 3.2.9
    • 3.3.3
    • 3.3.5
    • 3.4.0
    • 3.4.3
    • 3.4.6
    • 3.5.0
    • 3.6.0
    • 3.6.9
    • 3.7.6
    • 3.9.7
    • 4.1.3
    • 4.3.0
    Affected ranges
    • ECOSYSTEM: < 4.3.1

    Update to 4.3.1

Original sources

Check your server →