CVE-2018-14994: n/a vulnerability

CVE-2018-14994: The Essential Phone Android device with a build fingerprint of essential/mata/mata:8.1.0/OPM1.180104.166/29...

The Essential Phone Android device with a build fingerprint of essential/mata/mata:8.1.0/OPM1.180104.166/297:user/release-keys contains a pre-installed platform app with a package name of com.ts.android.hiddenmenu (versionName=1.0, platformBuildVersionName=8.1.0) that contains an exported activity app component named com.ts.android.hiddenmenu.rtn.RTNResetActivity that allows any app co-located on the device to programmatically initiate a factory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of a pre-installed platform app.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 5, 2024, 09:46 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

This CVE affects a specific Essential Phone Android 8.1.0 build. A preinstalled hidden-menu app exposed a factory reset function to ordinary installed apps. A malicious app on the same device could erase user data and apps without special permissions. The main business risk is device data loss, not confirmed data theft or remote compromise.

Executive priority

Treat this as a targeted mobile data-loss risk for legacy Essential Phone fleets. It is not evidenced as broadly exploited or remotely reachable, but devices holding business data should be inventoried and either remediated, tightly managed, or retired.

Technical view

The issue is an exported activity, com.ts.android.hiddenmenu.rtn.RTNResetActivity, in the preinstalled platform package com.ts.android.hiddenmenu version 1.0. The CVE states any co-located app can initiate a factory reset without permissions. Factory reset capability is normally unavailable to third-party apps except approved MDM contexts.

Likely exposure

Exposure appears narrow: Essential Phone devices with build fingerprint essential/mata/mata:8.1.0/OPM1.180104.166/297:user/release-keys. The source bundle does not identify other affected vendors, models, versions, or CPEs.

Exploitation context

CISA KEV status is false in the provided bundle, and no cited source states active exploitation. Exploitation requires an app already installed on the device. Impact is destructive data loss from factory reset, especially for unsynced or unbacked-up data.

Researcher notes

The evidence identifies an exported factory-reset activity in a preinstalled platform app, with no permission requirement for the initiating app. Sources do not provide CVSS, CWE, patched versions, broader affected products, or exploitation-in-the-wild evidence.

Mitigation direction

Identify and prioritize any remaining Essential Phone devices on the cited build.
Check vendor or fleet-management guidance for firmware updates, removal, or retirement options.
Restrict installation of untrusted apps on affected devices.
Ensure device data is backed up or synced externally.
Consider removing affected devices from business workflows if no vendor fix exists.

Validation and detection

Inventory Android devices for the cited Essential Phone build fingerprint.
Check whether package com.ts.android.hiddenmenu exists on candidate devices.
Use approved mobile assessment tooling to verify exported component exposure.
Review MDM policy coverage for app installation restrictions and backup posture.
Confirm whether vendor guidance or firmware updates exist for affected devices.

Prepared: Jun 6, 2026, 21:12 UTC (UTC+00:00)
Confidence: medium
Sources: 4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-14994 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Apr 25, 2019, 19:34 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdfCVE reference · x_refsource_MISC
https://www.kryptowire.com/portal/android-firmware-defcon-2018/CVE reference · x_refsource_MISC
https://www.kryptowire.com/CVE reference · x_refsource_MISC

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.