Security readout for executives and security teams
Plain-English summary
CVE-2025-57197 affects the Payeer Android application 2.5.0. A person who already has root-level access to the device may bypass the existing PIN check and change the app PIN. This is serious for compromised or rooted devices, but the attack is local and requires high device privileges.
Executive priority
Handle as a moderate mobile-app risk. It is not described as remotely exploitable, but it can undermine account control on rooted or compromised devices. Prioritize device hygiene, app version review, and vendor remediation tracking.
Technical view
The issue is improper access control in the PIN change authentication flow. The CVSS 3.1 vector is AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, score 6.0. Reported impact is unauthorized PIN modification without knowing the current PIN. The source bundle does not identify CPEs or confirmed patched versions.
Likely exposure
Exposure appears limited to Payeer Android application 2.5.0 on devices where an attacker has root access or equivalent control. Managed fleets permitting rooted Android devices have higher practical exposure.
Exploitation context
The source bundle describes local dynamic instrumentation by a root-level attacker. It does not cite active exploitation, and KEV status is false. No remote attack path is described.
Researcher notes
Evidence is limited to the CVE record and referenced public materials. The affected product metadata lists n/a, while the description names Payeer Android application 2.5.0. Patch status, vulnerable code details, and exploit-in-the-wild evidence are not established in the supplied sources.
Mitigation direction
- Check Payeer guidance for an updated Android application or official remediation.
- Do not use Payeer Android 2.5.0 on rooted or compromised devices.
- Use MDM controls to block rooted Android devices where business use is managed.
- Treat PIN changes from suspect devices as potentially unauthorized.
- Monitor vendor channels before declaring the issue fully remediated.
Validation and detection
- Inventory whether Payeer Android 2.5.0 is present on managed devices.
- Review MDM telemetry for rooted or compromised Android devices.
- Check account logs for unexpected PIN changes from suspect devices.
- Confirm whether Payeer has published a fixed Android version.
- Document residual risk if vendor remediation is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-57197 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N0.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://drive.google.com/drive/folders/1FHn4dFHeJ6W1IKlsB447v_hJoqqF9qgv?usp=sharingCVE reference, mitre
- https://payeer.com/CVE reference, mitre
- https://medium.com/@mhamdanali81/cve-2025-57197-breaking-the-pin-in-payeers-android-app-31e3cdee02efCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.