PT-2019-9085 · Oppo+1 · Oppo F5+1

Published

2019-04-25

·

Updated

2019-10-03

·

CVE-2018-14996

CVSS v2.0

7.2

High

VectorAV:L/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Oppo F5 Android device with a build fingerprint of OPPO/CPH1723/CPH1723:7.1.1/N6F26Q/1513597833:user/release-keys
Description The issue allows any app co-located on the device to supply arbitrary commands to be executed as the system user, due to an exported service named com.dropboxchmod.DropboxChmodService in a pre-installed platform app with a package name of com.dropboxchmod. This can enable a third-party app to perform various malicious actions, including video recording the user's screen, factory resetting the device, obtaining the user's notifications, reading the logcat logs, injecting events in the Graphical User Interface (GUI), and obtaining the user's text messages. Additionally, it can be used to secretly record audio of the user without their awareness.
Recommendations For the Oppo F5 Android device, consider disabling the com.dropboxchmod app or restricting its use until a patch is available. As a temporary workaround, avoid using the device for sensitive activities until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

CVE-2018-14996

Affected Products

Android
Oppo F5