CVE-2014-8610: Low severity Google Android vulnerability
AndroidManifest.xml in Android before 5.0.0 does not require the SENDSMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional per-message charges from a network operator for old messages, via a crafted application that broadcasts an intent with the com.android.mms.transaction.MESSAGESENT action, aka Bug 17671795.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8610?
CVE-2014-8610 has a medium severity rating due to its potential to allow unauthorized SMS message sending.
How do I fix CVE-2014-8610?
To fix CVE-2014-8610, update your Android device to version 5.0.0 or later, where the SEND_SMS permission is required.
What versions of Android are affected by CVE-2014-8610?
CVE-2014-8610 affects all Android versions prior to 5.0.0.
What can attackers do with CVE-2014-8610?
Attackers can send stored SMS messages and create draft messages without user's consent due to the lack of proper permissions.
Is my device vulnerable if I have an older version of Android?
Yes, if you are using an Android version before 5.0.0, your device is vulnerable to CVE-2014-8610.