CVE-2018-14992

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm (versionCode=1510500200, versionName=1.5.0.40_171122) has an exposed interface in an exported service named com.asus.dm.installer.DMInstallerService that allows any app co-located on the device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device can send an intent with specific embedded data that will cause the com.asus.dm app to programmatically download and install the app. For the app to be downloaded and installed, certain data needs to be provided: download URL, package name, version name from the app's AndroidManifest.xml file, and the MD5 hash of the app. Moreover, any app that is installed using this method can also be programmatically uninstalled using the same unprotected component named com.asus.dm.installer.DMInstallerService.

• https://www.kryptowire.com/portal/android-firmware-defcon-2018/Vendor Advisory
• https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdfExploit, Vendor Advisory
• https://www.kryptowire.com/portal/android-firmware-defcon-2018/Vendor Advisory
• https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdfExploit, Vendor Advisory

Published

Dec 28, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14986The Leagoo Z5C Android device with a build fingerprint of sp…
• CVE-2018-14987The MXQ TV Box 4.4.2 Android device with a build fingerprint…
• CVE-2018-14988The MXQ TV Box 4.4.2 Android device with a build fingerprint…
• CVE-2018-14989The Plum Compass Android device with a build fingerprint of …
• CVE-2018-14990The Coolpad Defiant device with a build fingerprint of Coolp…
• CVE-2018-14991The Coolpad Defiant device with a build fingerprint of Coolp…
• CVE-2018-14993The ASUS Zenfone V Live Android device with a build fingerpr…
• CVE-2018-14994The Essential Phone Android device with a build fingerprint …
• CVE-2018-14995The ZTE Blade Vantage Android device with a build fingerprin…
• CVE-2018-14996The Oppo F5 Android device with a build fingerprint of OPPO/…
• CVE-2018-14997The Leagoo P1 Android device with a build fingerprint of sp7…
• CVE-2018-14998The Leagoo P1 Android device with a build fingerprint of sp7…