NVD Vulnerability Detail

CVE-2018-14985

Summary	The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform app with a package name of com.android.settings (versionCode=23, versionName=6.0-android.20170630.092853) that contains an exported broadcast receiver that allows any app co-located on the device to programmatically initiate a factory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of a pre-installed platform app.
Publication Date	Dec. 29, 2018, 6:29 a.m.
Registration Date	March 1, 2021, 6:58 p.m.
Last Update	Nov. 21, 2024, 12:50 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://www.kryptowire.com/portal/android-firmware-defcon-2018/	Third Party Advisory
2	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf	Exploit Third Party Advisory
3	https://www.kryptowire.com/portal/android-firmware-defcon-2018/	Third Party Advisory
4	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-862	認証の欠如	https://cwe.mitre.org/data/definitions/862.html

JVN Vulnerability Information

Leagoo Z5C Android デバイスにおける認可・権限・アクセス制御に関する脆弱性

Title	Leagoo Z5C Android デバイスにおける認可・権限・アクセス制御に関する脆弱性
Summary	Leagoo Z5C Android デバイスには、認可・権限・アクセス制御に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 28, 2018, midnight
Registration Date	March 25, 2019, 4:42 p.m.
Last Update	March 25, 2019, 4:42 p.m.

Affected System

LEAGOO Global Co., Limited

Z5C ファームウェア 6.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-14985	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14985
2	CVE-2018-14985	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14985
National Vulnerability Database (NVD)
3	CVE-2018-14985	https://nvd.nist.gov/vuln/detail/CVE-2018-14985
4	CVE-2018-14985	https://nvd.nist.gov/vuln/detail/CVE-2018-14985

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html
2	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

その他

No	Name	URL
関連文書
1	Vulnerable Out of the Box:An Evaluation of Android Carrier Devices	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf
2	Vulnerable Out of the Box:An Evaluation of Android Carrier Devices	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf

Change Log

No	Changed Details	Date of change
1	[2019年03月25日] 掲載	March 25, 2019, 4:42 p.m.