CVE-2023-47889 is a high severity (CVSS 7.8) flaw in the Android app BINHDRM26 Super Reboot (package com.bdrm.superreboot) version 1.0.3. Its exported broadcast receivers let any other app on the phone trigger power off, reboot or recovery mode. No fixed version is documented, so uninstall the app.
What's affected
The record names a single product and version: BINHDRM26 Super Reboot, package com.bdrm.superreboot, version 1.0.3. The NVD description says the app exposes several critical actions through exported broadcast receivers, and that any app on the device can send unauthorised broadcasts to trigger them. The actions it lists are powering off, system reboot and entering recovery mode.
The record scores it 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack is local, so another app already on the device is the actor. The record gives the weakness as CWE-927 (Use of Implicit Intent for Sensitive Communication). The researcher's write-up on GitHub, which is the only reference, names both CWE-927 and CWE-925 (Improper Verification of Intent by Broadcast Receiver). That is a labelling difference in the sources, not a disagreement about the problem.
The write-up names PowerOffWidgetReceiver as a vulnerable component. I found no fixed version in the sources I fetched, and the record does not flag the CVE as exploited in the wild.
How to check if you're exposed
You can check a phone or an emulator from a computer with the Android debug bridge, if USB debugging is enabled.
adb shell pm list packages | grep com.bdrm.superreboot
adb shell dumpsys package com.bdrm.superreboot | grep versionName
If the first command prints the package name, the app is installed. The second prints the version. On a phone without a computer, open Settings, then Apps, and search for Super Reboot.
For managed fleets, query your mobile device management inventory for the package name. Pay attention to shared or kiosk devices, where an unexpected reboot causes the most harm.
What to do now
- Uninstall com.bdrm.superreboot from every device where it is installed.
- Check the developer or app store listing for a newer release and read its notes before reinstalling anything.
- Add the package name to a block list in your mobile device management tool.
- Review what other apps on the device you actually need, since this attack relies on a second app being present.
- If you build Android apps, check your own manifests for exported receivers, as described in the next section.
Why it matters
A broadcast receiver is a component that listens for system or app messages. When it is marked as exported and does not check who is sending, any installed app can send it a message. For a reboot utility that means any app can reboot, power off or put the device into recovery, with no permission prompt.
The impact here is mostly availability, but the record rates confidentiality and integrity as high too, and recovery mode is a state most owners never expect an app to reach. For developers, the fix pattern is simple to state: do not export receivers that perform sensitive actions, require a signature level permission, and verify the sender. See the Safeguard Gold page for this CVE for the record, and for the related sender check problem see the CWE-925 page linked above.
Quick check
Is there a patched version of Super Reboot?
I did not find a fixed version in the record or the write-up I fetched. Remove version 1.0.3 and check the app listing for any later release.
Does an attacker need physical access?
The vector is local, so the attacker is an app already installed on the device, not a person holding it.
Sources
Last reviewed: 19 October 2026.
