CVE-2016-10137

An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.

• CWE-310

• http://www.securityfocus.com/bid/96852
• https://www.kryptowire.com/adups_security_analysis.htmlTechnical Description, Third Party Advisory
• https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.htmlPress/Media Coverage
• http://www.securityfocus.com/bid/96852
• https://www.kryptowire.com/adups_security_analysis.htmlTechnical Description, Third Party Advisory
• https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.htmlPress/Media Coverage

Published

Jan 13, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10131system/libraries/Email.php in CodeIgniter before 3.1.3 allow…
• CVE-2016-10132regexp.c in Artifex Software, Inc. MuJS allows attackers to …
• CVE-2016-10133Heap-based buffer overflow in the js_stackoverflow function …
• CVE-2016-10134SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 …
• CVE-2016-10135An issue was discovered on LG devices using the MTK chipset …
• CVE-2016-10136An issue was discovered on BLU R1 HD devices with Shanghai A…
• CVE-2016-10138An issue was discovered on BLU Advance 5.0 and BLU R1 HD dev…
• CVE-2016-10139An issue was discovered on BLU R1 HD devices with Shanghai A…
• CVE-2016-1014Untrusted search path vulnerability in Adobe Flash Player be…7.3
• CVE-2016-10140Information disclosure and authentication bypass vulnerabili…
• CVE-2016-10141An integer overflow vulnerability was observed in the regemi…9.8
• CVE-2016-10142An issue was discovered in the IPv6 protocol specification, …