LiveActive security incident?Get immediate response
CVE Record

CVE-2018-14983: The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:u...

The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the android framework (i.e., system_server) with a package name of android (versionCode=24, versionName=7.0) that has been modified by Sony or another entity in the supply chain. The system_server process in the core android package has an exported broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screenshot be written to external storage. The taking of a screenshot is not transparent to the user; the device has a screen animation as the screenshot is taken and there is a notification indicating that a screenshot occurred. If the attacking app also requests the EXPAND_STATUS_BAR permission, it can wake the device up using certain techniques and expand the status bar to take a screenshot of the user's notifications even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_server process that provides this capability cannot be disabled, as it is part of the Android framework. The notification can be removed by a local Denial of Service (DoS) attack to reboot the device.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This issue affects a specific Sony Xperia L1 Android build. A malicious app already on the device could trigger screenshots, including potentially lock-screen notifications, and save them to external storage. The main business risk is leakage of sensitive notification content, including text-message authentication codes.

Executive priority

Treat as targeted mobile data-exposure risk, not broad enterprise network compromise. Prioritize if the organization still uses the named Sony Xperia L1 build for staff, contractors, or MFA workflows.

Technical view

The described Sony-modified Android 7.0 system_server exposes a broadcast receiver in the core android package. Any co-located app can invoke screenshot behavior. With EXPAND_STATUS_BAR, the app may expose notification content while locked. The source bundle names no CVSS, CWE, public patch, or confirmed exploitation.

Likely exposure

Exposure appears limited to Sony Xperia L1 G3313 devices on build fingerprint Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys. Risk requires a malicious or compromised app installed on the same device.

Exploitation context

The bundle does not show CISA KEV listing or active exploitation evidence. The attack is local-on-device through an installed app, not remote network compromise. User-visible screenshot animation and notification occur, though the notification could reportedly be removed via reboot-causing DoS.

Researcher notes

Evidence is narrow and build-specific. The source describes a vendor or supply-chain modification to system_server, exported broadcast receiver behavior, screenshot persistence to external storage, and lock-screen notification exposure. No exploit status, patch identifier, or full affected-version range is provided.

Mitigation direction

  • Inventory for the exact Sony Xperia L1 G3313 Android 7.0 build fingerprint.
  • Check Sony, carrier, or fleet vendor guidance for firmware updates or retirement advice.
  • Restrict sideloading and installation from untrusted app sources on affected devices.
  • Hide sensitive notification content on locked screens for affected mobile fleets.
  • Avoid SMS-based MFA on affected devices where practical.

Validation and detection

  • Confirm device model, Android version, and build fingerprint through MDM inventory.
  • Check whether affected devices permit untrusted app installation or sideloading.
  • Review lock-screen notification settings for sensitive message exposure.
  • Assess whether affected users receive MFA codes or secrets in notifications.
  • Confirm whether vendor-supported firmware is available for the exact device build.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-14983 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.