Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2025-68710 is a low-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Google (inferred from references). Its CVSS base score is 2.4 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-19 (Access Control for Mobile Devices) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
No EU or UK CSIRT advisories indexed for this CVE.
Vulnerability Data
Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading…
more
interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome), resulting in information disclosure and privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Bypass of insecure overlay-based PIN auth enables local privilege escalation (T1068) and directly subverts authentication process/MFA enforcement (T1556.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
- 7 hardening rules · 3 OS baselines
V6.4.3V6.6.1V12.1.3
Mitigating Controls (NIST 800-53 r5) AI
Directly requires proper enforcement of access control decisions rather than permitting bypass via overlay or exposed navigation routes.
Mandates secure access control mechanisms on mobile devices instead of insecure overlay implementations that allow physical-access bypass.
Requires use of approved identification and authentication methods (e.g., Android secure APIs) rather than alternate-path overlays.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Requiring authentication on every channel and path directly eliminates alternate-path bypasses.
Enforcing authorizations and least privilege across all access vectors prevents unauthenticated alternate paths.
Protecting networks and environments from unauthorized logical access blocks bypass via undocumented channels.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect alternate-path bypasses but does not prevent them in production.
Secure authentication control directly mitigates bypass by requiring strong, consistent authentication on all paths.
Access control policy directly addresses alternate authentication paths by requiring all channels to enforce authentication.
Authentication information management ensures credentials and mechanisms are consistently applied across all access paths.
Access rights provisioning and review prevent bypass via unmonitored or alternate channels.
Privileged access rights control reduces risk of bypass through elevated or alternate paths.