CVE-2018-15006 Denial of service in n/a

Medium 5.5 Published 28 Dec 2018 Updated 5 Aug 2024

A malicious app can trigger a crash loop in recovery mode on ZTE ZMAX Champ devices, rendering the device unusable.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-15006?

CVE-2018-15006 is a medium-severity denial of service vulnerability in n/a, published on 28 Dec 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a pre-installed platform app with a package name of com.android.zte.hiddenmenu (versionCode=23, versionName=6.0.1) that contains an exported broadcast receiver app component named com.android.zte.hiddenmenu.CommandReceiver that is accessible to any app co-located on the device. This app component, when it receives a broadcast intent with a certain action string, will write a non-standard (i.e., not defined in Android Open Source Project (AOSP) code) command to the /cache/recovery/command file to be executed in recovery mode. Once the device boots into recovery mode, it will crash, boot into recovery mode, and crash again. This crash loop will keep repeating, which makes the device unusable. There is no way to boot into an alternate mode once the crash loop starts.

Which versions are affected by CVE-2018-15006?

It affects 1 product.

Products include Zteusa Zte Zmax Champ Firmware.

How do I fix CVE-2018-15006?

No fix has been published for CVE-2018-15006 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-15006 being exploited?

There is no known exploitation of CVE-2018-15006 in the wild and no public exploit code.

CVE-2018-15005 Missing authorization in n/a High 7.1

Sources

Also known as GHSA-c25x-r4m5-7vg8.