PT-2025-43490 · Unknown · Mmsprovider.Java

Published 2025-10-23 · Updated 2026-03-06 · CVE-2025-48609

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions MmsProvider.java (affected versions not specified)

Description A path traversal error exists in multiple functions within MmsProvider.java, potentially allowing arbitrary file deletion affecting telephony, SMS, and MMS functionalities. This could result in a local denial of service without requiring additional execution privileges or user interaction. The vulnerable code is located at '/api/v1/mmsProvider' and involves file handling operations. The issue stems from insufficient validation of file paths, enabling an attacker to traverse directories and delete critical system files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ASB-A-414388731

CVE-2025-48609

Affected Products

Mmsprovider.Java

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-48609 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48609 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-414388731 · Vendor Advisory
• https://source.android.com/docs/security/bulletin/2026/2026-03-01 · Vendor Advisory
• https://twitter.com/cracbot/status/2029512459753849297 · Twitter Post
• https://twitter.com/TheHackerWire/status/2028867998107496946 · Twitter Post
• https://reddit.com/r/GalaxyS21/comments/1qqh2tt/s21_firmware_security_update_downloaded_in_usa · Reddit Post
• https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/37babc702849821595634b6ecfda6f04404e2cf1 · Note
• https://source.android.com/security/bulletin/2026-03-01 · Note
• https://twitter.com/cracbot/status/2029874926744916252 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post