CVE-2023-33293: Kaiostech Kaios

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fetch requests to api-deamon to determine if a given app is installed and read the manifest.webmanifest contents, including the app version.

Affected products

• Kaiostech Kaios: version 3.0 only; version 3.1 only

Published 2023-05-22. Last modified 2026-06-17.