PT-2018-12861 · Google+1 · Android+1

Published 2018-12-28 · Updated 2019-10-03 · CVE-2018-14985

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Leagoo Z5C Android device with a build fingerprint of sp7731c 1h10 32v4 bird:6.0/MRA58K/android.20170629.214736:user/release-keys

Description The device contains a pre-installed platform app with a package name of com.android.settings that has an exported broadcast receiver. This allows any app on the device to initiate a factory reset programmatically without requiring any permissions. A factory reset will remove all user data and apps, resulting in data loss if not backed up or synced externally.

Recommendations For the Leagoo Z5C Android device, consider disabling the com.android.settings app or restricting its functionality to prevent unauthorized factory resets until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2018-14985

Affected Products

Android

Leagoo Z5C

References · 4

• 🔥 https://kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14985 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14985 · Vendor Advisory
• https://kryptowire.com/portal/android-firmware-defcon-2018 · Note