LiveActive security incident?Get immediate response
CVE Record

CVE-2018-14990: The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/...

The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.app.service (versionCode=1, versionName=RCS_sdk_M_native_20161008_01; versionCode=1, versionName=RCS_sdk_M_native_20170406_01) with a broadcast receiver app component named com.suntek.mway.rcs.app.test.TestReceiver and a refactored version of the app with a package name of com.rcs.gsma.na.sdk (versionCode=1, versionName=RCS_SDK_20170804_01) with a broadcast receiver app component named com.rcs.gsma.na.test.TestReceiver allow any app co-located on the device to programmatically send text messages where the number and body of the text message is controlled by the attacker due to an exported broadcast receiver app component. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. A separate vulnerability in the app allows a zero-permission app to programmatically delete text messages, so the sent text messages can be removed to not alert the user.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Some listed carrier Android devices shipped with an RCS messaging app that another local app could abuse to send texts without user permission. The same app reportedly allowed message deletion, which could hide the activity from the user. Business impact is mainly unauthorized SMS activity, user trust loss, and device fleet risk.

Executive priority

Treat this as a high-priority legacy Android fleet issue where affected devices should be identified quickly and remediated or retired if vendors provide no fix.

Technical view

CVE-2018-14990 involves exported broadcast receiver components in preinstalled RCS apps on specified Coolpad, ZTE, and T-Mobile Revvl Plus builds. A zero-permission co-located app could control SMS recipient and body. The source also describes a separate message-deletion issue in the app. No CVSS, CWE, or vendor fix details are provided.

Likely exposure

Exposure appears limited to the specific device models, build fingerprints, package names, versions, and receiver components named in the CVE description unless additional vendor evidence expands scope.

Exploitation context

The provided sources do not state active exploitation, and KEV is false. The described attack requires a malicious or compromised app already present on the same device, but that app reportedly needs no Android permissions.

Researcher notes

The CVE description is unusually specific, but the structured affected-products field is not populated. Evidence does not include CVSS, CWE, exploit telemetry, or a named patch. Avoid broadening scope beyond the listed devices without vendor or firmware evidence.

Mitigation direction

  • Inventory Android fleet for the named models, builds, packages, and app versions.
  • Check carrier or vendor firmware guidance for fixed builds or replacement paths.
  • Restrict affected devices from sensitive enterprise use if no fixed firmware is available.
  • Use MDM controls to reduce untrusted app installation on affected devices.
  • Monitor SMS billing and user reports for unauthorized message activity.

Validation and detection

  • Compare device build fingerprints against the CVE-listed fingerprints.
  • Check installed packages for the named RCS package names and versions.
  • Review app component metadata for the named exported receivers without sending messages.
  • Confirm whether vendor firmware updates remove or correct the affected RCS app.
  • Review SMS records for unexplained outbound messages on affected devices.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-14990 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.