CVE-2018-14990: Input Validation
First published: Thu Apr 25 2019(Updated: )
The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.app.service (versionCode=1, versionName=RCS_sdk_M_native_20161008_01; versionCode=1, versionName=RCS_sdk_M_native_20170406_01) with a broadcast receiver app component named com.suntek.mway.rcs.app.test.TestReceiver and a refactored version of the app with a package name of com.rcs.gsma.na.sdk (versionCode=1, versionName=RCS_SDK_20170804_01) with a broadcast receiver app component named com.rcs.gsma.na.test.TestReceiver allow any app co-located on the device to programmatically send text messages where the number and body of the text message is controlled by the attacker due to an exported broadcast receiver app component. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. A separate vulnerability in the app allows a zero-permission app to programmatically delete text messages, so the sent text messages can be removed to not alert the user.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Coolpad Defiant Firmware | ||
| Coolpad Defiant Firmware | ||
| T-Mobile Revvl Plus Firmware | ||
| T-Mobile Revvl Plus Firmware | ||
| ZTE Zmax Pro | ||
| T-Mobile ZTE Zmax Pro Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-14990?
CVE-2018-14990 is considered a critical vulnerability that affects multiple mobile devices.
How do I fix CVE-2018-14990?
To mitigate CVE-2018-14990, users should update their devices to the latest security firmware provided by the manufacturer.
Which devices are affected by CVE-2018-14990?
CVE-2018-14990 affects the Coolpad Defiant, ZTE ZMAX Pro, and T-Mobile Revvl Plus devices.
What type of vulnerability is CVE-2018-14990?
CVE-2018-14990 is a vulnerability that allows for potential unauthorized access and manipulation of device data.
Is CVE-2018-14990 related to any specific software?
Yes, CVE-2018-14990 is associated with specific firmware versions of the affected mobile devices.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/coolpad
- canonical/coolpad defiant firmware
- vendor/t-mobile
- canonical/t-mobile revvl plus firmware
- canonical/zte zmax pro
- canonical/t-mobile zte zmax pro firmware