CVE-2018-14996

The Oppo F5 Android device with a build fingerprint of OPPO/CPH1723/CPH1723:7.1.1/N6F26Q/1513597833:user/release-keys contains a pre-installed platform app with a package name of com.dropboxchmod (versionCode=1, versionName=1.0) that contains an exported service named com.dropboxchmod.DropboxChmodService that allows any app co-located on the device to supply arbitrary commands to be executed as the system user. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. This vulnerability can also be used to secretly record audio of the user without their awareness on the Oppo F5 device. The pre-installed com.oppo.engineermode app (versionCode=25, versionName=V1.01) has an exported activity that can be started to initiate a recording and quickly dismissed. The activity can be started in a way that the user will not be able to see the app in the recent apps list. The resulting audio amr file can be copied from a location on internal storage using the arbitrary command execution as system user vulnerability. Executing commands as system user can allow a third-party app to factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, obtain the user's text messages, and more.

• https://www.kryptowire.comThird Party Advisory
• https://www.kryptowire.com/portal/android-firmware-defcon-2018/Third Party Advisory
• https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdfTechnical Description, Third Party Advisory
• https://www.kryptowire.comThird Party Advisory
• https://www.kryptowire.com/portal/android-firmware-defcon-2018/Third Party Advisory
• https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdfTechnical Description, Third Party Advisory

Published

Apr 25, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14990The Coolpad Defiant device with a build fingerprint of Coolp…
• CVE-2018-14991The Coolpad Defiant device with a build fingerprint of Coolp…
• CVE-2018-14992The ASUS ZenFone 3 Max Android device with a build fingerpri…
• CVE-2018-14993The ASUS Zenfone V Live Android device with a build fingerpr…
• CVE-2018-14994The Essential Phone Android device with a build fingerprint …
• CVE-2018-14995The ZTE Blade Vantage Android device with a build fingerprin…
• CVE-2018-14997The Leagoo P1 Android device with a build fingerprint of sp7…
• CVE-2018-14998The Leagoo P1 Android device with a build fingerprint of sp7…
• CVE-2018-14999The Leagoo P1 device with a build fingerprint of sp7731c_1h1…
• CVE-2018-15000The Vivo V7 Android device with a build fingerprint of vivo/…
• CVE-2018-15001The Vivo V7 Android device with a build fingerprint of vivo/…
• CVE-2018-15002The Vivo V7 device with a build fingerprint of vivo/1718/171…