CVE-2018-15006: Medium severity zte zmax champ vulnerability
The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a pre-installed platform app with a package name of com.android.zte.hiddenmenu (versionCode=23, versionName=6.0.1) that contains an exported broadcast receiver app component named com.android.zte.hiddenmenu.CommandReceiver that is accessible to any app co-located on the device. This app component, when it receives a broadcast intent with a certain action string, will write a non-standard (i.e., not defined in Android Open Source Project (AOSP) code) command to the /cache/recovery/command file to be executed in recovery mode. Once the device boots into recovery mode, it will crash, boot into recovery mode, and crash again. This crash loop will keep repeating, which makes the device unusable. There is no way to boot into an alternate mode once the crash loop starts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15006?
CVE-2018-15006 has been classified with a moderate severity, as it allows unauthorized access to a pre-installed platform app.
How do I fix CVE-2018-15006?
To fix CVE-2018-15006, users should ensure they are using a firmware version beyond 6.0.1, where possible, or remove the vulnerable application.
What devices are affected by CVE-2018-15006?
CVE-2018-15006 specifically affects the ZTE ZMAX Champ Android device running firmware version 6.0.1.
What does the exported broadcast receiver in CVE-2018-15006 allow?
The exported broadcast receiver in CVE-2018-15006 allows potentially malicious apps to send broadcasts and gain access to sensitive functions.
Is CVE-2018-15006 still a risk if the vulnerable app is disabled?
Disabling the vulnerable app may reduce the risk, but users should ideally uninstall or update to the latest firmware to fully mitigate the vulnerability.