Tecno manufactures a range of consumer mobile devices and related services including the AudioLink audio application, BoomPlay streaming service, CarCare maintenance platform, and HIOS firmware, presenting a modest but globally distributed attack surface. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and recur across weakness classes including improper authentication, certificate validation failures, incorrect authorization enforcement, and exposed dangerous methods, reflecting the risks inherent to mobile applications and firmware that handle user credentials and sensitive device functions. Defenders should prioritize Tecno device and service updates where authentication or device-management exposure exists; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tecno over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-15385CRITICAL Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.Boomplayer: 7.4.63. | Jan 6, 2026 | 9.8 | 31 | NO | NO |
CVE-2024-3701CRITICAL The system application (com.transsion.kolun.aiservice) component does not perform an authentication check, which allows attackers to perform malicious exploitations and affect syst | Apr 15, 2024 | 9.8 | 29 | NO | NO |
CVE-2025-2190HIGH The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks. | Mar 11, 2025 | 8.1 | 22 | NO | NO |
CVE-2019-15417HIGH The Tecno Spark Pro Android device with a build fingerprint of TECNO/H3722/TECNO-K8:7.0/NRD90M/K8-H3722ABCDE-N-171229V96:user/release-keys contains a pre-installed app with a packa | Nov 14, 2019 | 7.8 | 22 | NO | NO |
CVE-2025-9056MEDIUM Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation. | Dec 10, 2025 | 5.3 | 21 | NO | NO |
CVE-2025-3698HIGH Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk. | Apr 16, 2025 | 7.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tecno.
Media articles that mention a CVE ID that affects a product developed by Tecno — matched by CVE ID, not by vendor name.