Privilege escalation in Mobsf Mobile-Security-Framework-Mobsf
CVE-2025-24805
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: Privilege Escalation
EPSS: 0.003 (27.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Mobsf Mobile-security-framework-mobsf — versions = 4.3.0
- Opensecurity Mobile_security_framework
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-24805?
- CVE-2025-24805 is a medium-severity vulnerability in Mobsf Mobile-Security-Framework-Mobsf, classified under Improper Privilege Management. CVSS score: 5.5/10. Published 2025-02-05.
- How severe is CVE-2025-24805?
- Medium severity. CVSS v3 base score is 5.5 out of 10.