LiveActive security incident?Get immediate response
CVE Record

CVE-2018-14980: The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_P...

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains the android framework (i.e., system_server) with a package name of android (versionCode=24, versionName=7.0) that has been modified by ASUS or another entity in the supply chain. The system_server process in the core android package has an exported broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screenshot be written to external storage (i.e., sdcard). The taking of a screenshot is not transparent to the user; the device has a screen animation as the screenshot is taken and there is a notification indicating that a screenshot occurred. If the attacking app also requests the EXPAND_STATUS_BAR permission, it can wake the device up using certain techniques and expand the status bar to take a screenshot of the user's notifications even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_server process that provides this capability cannot be disabled, as it is part of the Android framework. The notification can be removed by a local Denial of Service (DoS) attack to reboot the device.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This issue affects a specific ASUS ZenFone 3 Max Android 7.0 build. A malicious app already on the phone could trigger screenshots and save them to shared external storage, potentially exposing notifications such as one-time codes. The sources do not name a patch or active exploitation.

Executive priority

Treat this as a targeted mobile exposure, not an enterprise-wide emergency unless the affected ASUS build is deployed. Priority should be inventory first, then retire or tightly restrict affected devices used for authentication, messaging, or sensitive business workflows.

Technical view

The ASUS-modified Android framework system_server includes an exported broadcast receiver in the android package. Any co-located app can invoke screenshot capture, writing output to sdcard. With status-bar expansion capability and wake behavior, notification contents may be captured even with screen lock. The system_server component cannot be disabled.

Likely exposure

Exposure appears limited to ASUS ZenFone 3 Max devices matching the cited ASUS_X008_1 Android 7.0 build fingerprint. Risk requires an app already installed on the device. Organizations without this model/build, or without unmanaged app installation, are less likely exposed.

Exploitation context

The bundle does not report CISA KEV listing or active exploitation. Abuse is local app-based, not remote network exploitation. Screenshot capture is partly user-visible through animation and notification, though the source states the notification can be removed through a local denial-of-service reboot condition.

Researcher notes

The public record is descriptive but incomplete: no CVSS, CWE, vendor advisory, patch version, or broad affected-version list is provided in the bundle. Avoid extrapolating beyond the named build. The key risk is confidentiality loss through framework-level screenshot behavior reachable by local apps.

Mitigation direction

  • Inventory for the exact ASUS ZenFone 3 Max build fingerprint.
  • Check ASUS or device-management guidance for firmware updates or retirement.
  • Remove untrusted or sideloaded apps from affected devices.
  • Restrict affected devices from MFA and sensitive notification workflows.
  • Hide sensitive lock-screen notification previews where policy allows.

Validation and detection

  • Confirm device model, Android version, and build fingerprint in MDM inventory.
  • Review installed apps for unmanaged or sideloaded packages on affected devices.
  • Check whether external storage contains unexpected screenshot artifacts.
  • Verify lock-screen notification settings for sensitive applications.
  • Document whether ASUS has published newer supported firmware.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-14980 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.