CVE-2018-14993 Privilege escalation in n/a

High 7.8 Published 25 Apr 2019 Updated 5 Aug 2024

A pre-installed ASUS app allows any local app to execute arbitrary commands as system user, enabling full device compromise and data theft.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-14993?

CVE-2018-14993 is a high-severity vulnerability in n/a, published on 25 Apr 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The ASUS Zenfone V Live Android device with a build fingerprint of asus/VZW_ASUS_A009/ASUS_A009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/release-keys and the Asus ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys both contain a pre-installed platform app with a package name of com.asus.splendidcommandagent (versionCode=1510200090, versionName=1.2.0.18_160928) that contains an exported service named com.asus.splendidcommandagent.SplendidCommandAgentService that allows any app co-located on the device to supply arbitrary commands to be executed as the system user. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, obtain the user's text messages, and more.

Which versions are affected by CVE-2018-14993?

It affects 2 products.

Products include Asus Zenfone 3 Max Firmware, Asus Zenfone v Live Firmware.

How do I fix CVE-2018-14993?

No fix has been published for CVE-2018-14993 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-14993 being exploited?

There is no known exploitation of CVE-2018-14993 in the wild and no public exploit code.

Sources

Also known as GHSA-xv96-jcmp-mq3q.