PT-2019-9083 · Asus · Asus Zenfone Live+1

Published 2019-04-25 · Updated 2019-10-03 · CVE-2018-14993

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUS Zenfone V Live version 7.1.1 ASUS Zenfone 3 Max version 7.0

Description The pre-installed platform app com.asus.splendidcommandagent contains an exported service named com.asus.splendidcommandagent.SplendidCommandAgentService that allows any app co-located on the device to supply arbitrary commands to be executed as the system user. This can enable a third-party app to perform various malicious actions, such as video recording the user's screen, factory resetting the device, obtaining the user's notifications, reading the logcat logs, injecting events in the Graphical User Interface (GUI), changing the default Input Method Editor (IME) with one contained within the attacking app that contains keylogging functionality, and obtaining the user's text messages.

Recommendations For ASUS Zenfone V Live version 7.1.1: Consider disabling the com.asus.splendidcommandagent app or restricting its functionality until a patch is available. For ASUS Zenfone 3 Max version 7.0: Consider disabling the com.asus.splendidcommandagent app or restricting its functionality until a patch is available. As a temporary workaround, consider restricting access to the com.asus.splendidcommandagent.SplendidCommandAgentService service to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-14993

Affected Products

Asus Zenfone 3 Max

Asus Zenfone Live

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-14993 · Security Note
• https://kryptowire.com/portal/android-firmware-defcon-2018 · Note
• https://kryptowire.com · Note
• https://kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf · Note