CVE-2018-14992
First published: Fri Dec 28 2018(Updated: )
The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm (versionCode=1510500200, versionName=1.5.0.40_171122) has an exposed interface in an exported service named com.asus.dm.installer.DMInstallerService that allows any app co-located on the device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device can send an intent with specific embedded data that will cause the com.asus.dm app to programmatically download and install the app. For the app to be downloaded and installed, certain data needs to be provided: download URL, package name, version name from the app's AndroidManifest.xml file, and the MD5 hash of the app. Moreover, any app that is installed using this method can also be programmatically uninstalled using the same unprotected component named com.asus.dm.installer.DMInstallerService.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Asus Zenfone 3 Max Firmware | =1.5.0.40 | |
| Asus ZenFone 3 Max |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-14992?
CVE-2018-14992 is classified as a high-severity vulnerability due to its potential for unauthorized access and data exposure.
How do I fix CVE-2018-14992?
To fix CVE-2018-14992, users should update the ASUS ZenFone 3 Max to the latest firmware version provided by ASUS.
What devices are affected by CVE-2018-14992?
CVE-2018-14992 specifically affects the ASUS ZenFone 3 Max running firmware version 1.5.0.40.
What type of vulnerability is CVE-2018-14992?
CVE-2018-14992 is an exposed component vulnerability that allows for unauthorized access to sensitive app functionalities.
Is CVE-2018-14992 a hardware vulnerability?
No, CVE-2018-14992 is a software vulnerability associated with a specific app on the ASUS ZenFone 3 Max.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- vendor/asus
- canonical/asus zenfone 3 max firmware
- version/asus zenfone 3 max firmware/1.5.0.40
- canonical/asus zenfone 3 max