CVE-2018-14984: Infoleak
First published: Fri Dec 28 2018(Updated: )
The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed app with a package name of com.android.messaging (versionCode=1000110, versionName=1.0.001, (android.20170630.092853-0)) with an exported broadcast receiver app component named com.android.messaging.trackersender.TrackerSender. Any app co-located on the device, even one with no permissions, can send a broadcast intent with certain embedded data to the exported broadcast receiver application component that will result in the programmatic sending of a text message where the phone number and body of the text message is controlled by the attacker.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Leagoo Z5c Firmware | ||
| Leagoo Z5C |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability CVE-2018-14984?
The vulnerability CVE-2018-14984 refers to a pre-installed app on the Leagoo Z5C Android device with a package name of com.android.messaging that has an exported broadcast receiver component with no permissions, allowing an attacker to execute arbitrary code with the app's privileges.
What is the severity of CVE-2018-14984?
The severity of CVE-2018-14984 is high with a CVSS score of 7.5.
What software is affected by CVE-2018-14984?
The Leagoo Z5C Android device with a firmware version of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys is affected by CVE-2018-14984.
How can an attacker exploit CVE-2018-14984?
An attacker can exploit CVE-2018-14984 by sending a specially crafted broadcast intent to the com.android.messaging app, which will be received by the exported broadcast receiver component and execute arbitrary code with the app's privileges.
Are Leagoo Z5C devices vulnerable to CVE-2018-14984?
Yes, Leagoo Z5C devices with the affected firmware version are vulnerable to CVE-2018-14984.
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/tags
- agent/event
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/leagoo
- canonical/leagoo z5c firmware
- canonical/leagoo z5c