PT-2018-12860 · Google+1 · Android+1

Published 2018-12-28 · Updated 2019-02-14 · CVE-2018-14984

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Leagoo Z5C Android device with a build fingerprint of sp7731c 1h10 32v4 bird:6.0/MRA58K/android.20170629.214736:user/release-keys

Description The issue concerns a pre-installed app with a package name of com.android.messaging that has an exported broadcast receiver app component named com.android.messaging.trackersender.TrackerSender. This allows any app on the device to send a broadcast intent with specific data to the receiver, resulting in the sending of a text message. The phone number and body of the text message can be controlled by the attacker.

Recommendations For the Leagoo Z5C Android device, consider disabling the com.android.messaging.trackersender.TrackerSender component until a patch is available to prevent potential exploitation. Restrict access to the com.android.messaging app to minimize the risk of unauthorized text message sending.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-14984

Affected Products

Android

Leagoo Z5C

References · 3

• 🔥 https://kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14984 · Security Note
• https://kryptowire.com/portal/android-firmware-defcon-2018 · Note