PT-2018-12872 · Google+1 · Android+1

Published 2018-12-28 · Updated 2019-10-03 · CVE-2018-15006

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys

Description The device contains a pre-installed platform app with a package name of com.android.zte.hiddenmenu that has an exported broadcast receiver app component named com.android.zte.hiddenmenu.CommandReceiver. This component is accessible to any app co-located on the device and can write a non-standard command to the /cache/recovery/command file when it receives a broadcast intent with a certain action string. As a result, the device will crash, boot into recovery mode, and crash again, creating a crash loop that makes the device unusable.

Recommendations For the ZTE ZMAX Champ Android device with the specified build fingerprint, consider disabling the com.android.zte.hiddenmenu.CommandReceiver component to prevent the crash loop. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2018-15006

Affected Products

Android

Zte Zmax Champ

References · 5

• 🔥 https://kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2018-15006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15006 · Security Note
• http://securityfocus.com/bid/106361 · Note
• https://kryptowire.com/portal/android-firmware-defcon-2018 · Note