Medium severity4.6NVD Advisory· Published Nov 3, 2023· Updated Jun 17, 2026

CVE-2023-36620

Description

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is used to authenticate requests to the API.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nationaledtech/Boomerang
cpe:2.3:a:nationaledtech:boomerang:*:*:*:*:*:android:*:*
Range: <13.83
Boomerang/Boomerang Parental Controldescription
Boomerang Parental Control/Boomerang Parental Controlllm-create
Range: <13.83

Patches

Vulnerability mechanics

References

seclists.org/fulldisclosure/2023/Jul/12nvdExploitMailing ListThird Party Advisory
sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/nvdThird Party Advisory
useboomerang.comnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.299
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000