PT-2018-12871 · Google+1 · Android+1

Publicado 2018-12-28 · Atualizado 2019-10-03 · CVE-2018-15005

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys

Description The device contains a pre-installed platform app with a package name of com.zte.zdm.sdm that has an exported broadcast receiver app component named com.zte.zdm.VdmcBroadcastReceiver. This component allows any app co-located on the device to initiate a factory reset programmatically without requiring any permissions. A factory reset will remove all user data and apps from the device, resulting in the loss of any data that have not been backed up or synced externally.

Recommendations For the ZTE ZMAX Champ Android device with the specified build fingerprint, consider disabling the com.zte.zdm.VdmcBroadcastReceiver component to prevent unauthorized factory resets until a patch is available. Restrict access to the com.zte.zdm.sdm app to minimize the risk of exploitation.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2018-15005

Produtos afetados

Android

Zte Zmax Champ

Referências · 5

• 🔥 https://kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf · Exploit
• http://securityfocus.com/bid/106361 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15005 · Nota de Segurança
• https://kryptowire.com/portal/android-firmware-defcon-2018 · Nota
• https://osv.dev/vulnerability/CVE-2018-15005 · Aviso do Fabricante