ByteOS Network

NVD Vulnerability Details :

CVE-2018-14992

Analyzed

Source-cve@mitre.org

Published At-28 Dec, 2018 | 21:29

Updated At-24 Aug, 2020 | 17:37

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm (versionCode=1510500200, versionName=1.5.0.40_171122) has an exposed interface in an exported service named com.asus.dm.installer.DMInstallerService that allows any app co-located on the device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device can send an intent with specific embedded data that will cause the com.asus.dm app to programmatically download and install the app. For the app to be downloaded and installed, certain data needs to be provided: download URL, package name, version name from the app's AndroidManifest.xml file, and the MD5 hash of the app. Moreover, any app that is installed using this method can also be programmatically uninstalled using the same unprotected component named com.asus.dm.installer.DMInstallerService.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:N

CPE Matches

ASUS (ASUSTeK Computer Inc.)

>>zenfone_3_max_firmware>>1.5.0.40

cpe:2.3:o:asus:zenfone_3_max_firmware:1.5.0.40:*:*:*:*:*:*:*

ASUS (ASUSTeK Computer Inc.)

>>zenfone_3_max>>-

cpe:2.3:h:asus:zenfone_3_max:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://www.kryptowire.com/portal/android-firmware-defcon-2018/	cve@mitre.org	Vendor Advisory
https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf	cve@mitre.org	Exploit Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History