Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider com.bluebird.kiosk.launcher.IpartnerKioskRemoteService. A local attacker can bind to the AIDL-type service to modify devices global settings and wallpaper image.
This issue affects all versions before 1.1.2.
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
The attacks and consequences of improperly exporting a component may depend on the exported component: