CVE-2018-14988

The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android framework with a package name of android (versionCode=19, versionName=4.4.2-20170213) that contains an exported broadcast receiver application component that, when called, will make the device inoperable. The vulnerable component named com.android.server.SystemRestoreReceiver will write a value of --restore_system\n--locale=<localeto the /cache/recovery/command file and boot into recovery mode. During this process, it appears that when booting into recovery mode, the system partition gets formatted or modified and will be unable to boot properly thereafter. After the device wouldn't boot properly, a factory reset of the device in recovery mode does not regain properly functionality of the device. The com.android.server.SystemRestoreReceiver broadcast receiver app component is accessible to any app co-located on the device and does not require any permission to access. The user can most likely recover the device by flashing clean firmware images placed on an SD card.

• CWE-20

• https://www.kryptowire.com/portal/android-firmware-defcon-2018/Third Party Advisory
• https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdfThird Party Advisory
• https://www.kryptowire.com/portal/android-firmware-defcon-2018/Third Party Advisory
• https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdfThird Party Advisory

Published

Dec 28, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14982Certain LG devices based on Android 6.0 through 8.1 have inc…
• CVE-2018-14983The Sony Xperia L1 Android device with a build fingerprint o…
• CVE-2018-14984The Leagoo Z5C Android device with a build fingerprint of sp…
• CVE-2018-14985The Leagoo Z5C Android device with a build fingerprint of sp…
• CVE-2018-14986The Leagoo Z5C Android device with a build fingerprint of sp…
• CVE-2018-14987The MXQ TV Box 4.4.2 Android device with a build fingerprint…
• CVE-2018-14989The Plum Compass Android device with a build fingerprint of …
• CVE-2018-14990The Coolpad Defiant device with a build fingerprint of Coolp…
• CVE-2018-14991The Coolpad Defiant device with a build fingerprint of Coolp…
• CVE-2018-14992The ASUS ZenFone 3 Max Android device with a build fingerpri…
• CVE-2018-14993The ASUS Zenfone V Live Android device with a build fingerpr…
• CVE-2018-14994The Essential Phone Android device with a build fingerprint …