Executive brief
The Lotus Cars Android application, used by vehicle owners to interact with their cars, contains a configuration error that allows the app's internal data to be backed up to an external computer. If an attacker gains physical access to a user's device or if the device is compromised, they could extract sensitive user information stored within the app. This could lead to the exposure of personal data or credentials used to manage the vehicle.
Technical details
The Lotus Cars Android application (com.lotus.carsdomestic.intl) version 1.2.8 incorrectly enables the 'allowBackup' flag within its AndroidManifest.xml file. This configuration allows an attacker with physical access to the device and Android Debug Bridge (ADB) enabled, or a user on a rooted device, to perform a full application data backup. By executing 'adb backup', an attacker can extract the application's private data directory to a local machine for offline analysis. This can result in the unauthorized exfiltration of sensitive user data, session tokens, or configuration files stored in the app's internal storage. The vulnerability is classified as Insecure Data Storage (CWE-200).
Affected products
- Lotus Cars Lotus Cars Android app 1.2.8
Timeline
- 2025-05: disclosed: Reported to vendor
- 2025-08-14: advisory: NVD Published Date