Attack Chain

1. Attacker installs a malicious application on the Android device.
2. The malicious application identifies the writable file descriptor associated with the Motorola Factory Test component in external storage.
3. The malicious application leverages the writable file descriptor to open a TCP server.
4. The TCP server allows the malicious application to intercept communications intended for the Motorola Factory Test component.
5. The malicious application bypasses authentication checks due to the exposed permissions.
6. The malicious application gains unauthorized access to protected device settings.
7. The attacker modifies sensitive device configurations, potentially compromising device security and user data.

Impact

Successful exploitation of CVE-2026-5804 allows a local attacker to bypass permission checks and access protected device settings on affected Motorola devices. This could lead to unauthorized modification of device configurations, exposure of sensitive data, and overall compromise of device security. The vulnerability has a CVSS v3.1 base score of 8.4, indicating a high severity.

Recommendation

• Apply the security update provided by Lenovo as described in the Motorola support article to patch CVE-2026-5804 (https://en-us.support.motorola.com/app/answers/detail/a_id/192534).
• Deploy the Sigma rule provided below to detect applications attempting to access the Motorola Factory Test component via TCP connections.