CVE-2018-14990 Missing authorization in n/a
A zero-permission app can send and delete text messages via an exported broadcast receiver in the pre-installed RCS app on specific Android devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-14990?
CVE-2018-14990 is a high-severity missing authorization vulnerability in n/a, published on 25 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.app.service (versionCode=1, versionName=RCS_sdk_M_native_20161008_01; versionCode=1, versionName=RCS_sdk_M_native_20170406_01) with a broadcast receiver app component named com.suntek.mway.rcs.app.test.TestReceiver and a refactored version of the app with a package name of com.rcs.gsma.na.sdk (versionCode=1, versionName=RCS_SDK_20170804_01) with a broadcast receiver app component named com.rcs.gsma.na.test.TestReceiver allow any app co-located on the device to programmatically send text messages where the number and body of the text message is controlled by the attacker due to an exported broadcast receiver app component. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. A separate vulnerability in the app allows a zero-permission app to programmatically delete text messages, so the sent text messages can be removed to not alert the user.
Weakness: CWE-20
Which versions are affected by CVE-2018-14990?
It affects 3 products.
Products include Coolpad Defiant Firmware, T-Mobile Revvl Plus Firmware, T-Mobile Zte Zmax Pro Firmware.
How do I fix CVE-2018-14990?
No fix has been published for CVE-2018-14990 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-14990 being exploited?
There is no known exploitation of CVE-2018-14990 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7mpj-2f2g-43m6.