PT-2019-9085 · Oppo+1 · Oppo F5+1
Published
2019-04-25
·
Updated
2019-10-03
·
CVE-2018-14996
CVSS v2.0
7.2
High
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Oppo F5 Android device with a build fingerprint of OPPO/CPH1723/CPH1723:7.1.1/N6F26Q/1513597833:user/release-keys
Description
The issue allows any app co-located on the device to supply arbitrary commands to be executed as the system user, due to an exported service named
com.dropboxchmod.DropboxChmodService in a pre-installed platform app with a package name of com.dropboxchmod. This can enable a third-party app to perform various malicious actions, including video recording the user's screen, factory resetting the device, obtaining the user's notifications, reading the logcat logs, injecting events in the Graphical User Interface (GUI), and obtaining the user's text messages. Additionally, it can be used to secretly record audio of the user without their awareness.Recommendations
For the Oppo F5 Android device, consider disabling the
com.dropboxchmod app or restricting its use until a patch is available. As a temporary workaround, avoid using the device for sensitive activities until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Android
Oppo F5