CVE-2025-9677 in Legend of the Phoenix
Summary
by MITRE • 08/30/2025
A security flaw has been discovered in Modo Legend of the Phoenix up to 1.0.5. The affected element is an unknown function of the file AndroidManifest.xml of the component com.duige.hzw.multilingual. The manipulation results in improper export of android application components. The attack needs to be approached locally. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/08/2025
The vulnerability identified as CVE-2025-9677 represents a critical security flaw within the Modo Legend of the Phoenix mobile application version 1.0.5 and earlier. This issue manifests within the AndroidManifest.xml file of the com.duige.hzw.multilingual component, where an improper export of application components has been detected. The vulnerability stems from a lack of proper security controls in the Android application manifest, which governs how application components interact with the operating system and other applications. According to CWE-707, this flaw falls under improper export of Android application components, a category that directly impacts the principle of least privilege and application security boundaries.
The technical exploitation of this vulnerability requires local access to the device, indicating that an attacker must already have physical or administrative access to the target system. This local requirement reduces the attack surface but does not eliminate the threat, particularly in scenarios where devices may be compromised through other means or where users may inadvertently grant access to malicious actors. The fact that a public exploit has been released significantly increases the risk profile, as it removes the need for sophisticated attack development and makes the vulnerability immediately actionable by threat actors. The Android platform's security model relies heavily on proper manifest configuration to prevent unauthorized access to application components, and this flaw directly undermines those protective mechanisms.
The operational impact of CVE-2025-9677 extends beyond simple data exposure, potentially enabling attackers to manipulate application behavior, access sensitive information, or escalate privileges within the application's context. This vulnerability directly relates to ATT&CK technique T1068, which involves exploiting local system privileges, and may also connect to T1548.002, which covers abuse of application permissions. The improper export of components can lead to unauthorized access to application functionalities, potentially allowing attackers to execute arbitrary code or manipulate application state. Given that the vendor failed to respond to early disclosure attempts, users remain exposed to this vulnerability without official patches or mitigations, creating a window of opportunity for malicious exploitation.
Mitigation strategies for this vulnerability should focus on immediate defensive measures including disabling or removing the vulnerable component from affected applications, implementing proper manifest configurations that restrict component exports, and conducting thorough security audits of Android application manifests. Organizations should consider implementing runtime application self-protection measures and monitoring for suspicious component access patterns. The vulnerability highlights the critical importance of vendor response in security disclosure processes, as the lack of vendor engagement creates prolonged exposure windows. Security professionals should also consider this vulnerability in the context of broader mobile application security practices and ensure that proper security controls are implemented in all application components to prevent similar issues in the future.