CVE-2018-14997

The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains the android framework (i.e., system_server) with a package name of android that has been modified by Leagoo or another entity in the supply chain. The system_server process in the core Android package has an exported broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screenshot be written to external storage. The taking of a screenshot is not transparent to the user; the device has a screen animation as the screenshot is taken and there is a notification indicating that a screenshot occurred. If the attacking app also requests the EXPAND_STATUS_BAR permission, it can wake the device up using certain techniques and expand the status bar to take a screenshot of the user's notifications even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_server process that provides this capability cannot be disabled, as it is part of the Android framework. The notification can be removed by a local Denial of Service (DoS) attack to reboot the device.

• CWE-862

• https://www.kryptowire.comThird Party Advisory
• https://www.kryptowire.com/portal/android-firmware-defcon-2018/Third Party Advisory
• https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdfTechnical Description, Third Party Advisory
• https://www.kryptowire.comThird Party Advisory
• https://www.kryptowire.com/portal/android-firmware-defcon-2018/Third Party Advisory
• https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdfTechnical Description, Third Party Advisory

Published

Apr 25, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14991The Coolpad Defiant device with a build fingerprint of Coolp…
• CVE-2018-14992The ASUS ZenFone 3 Max Android device with a build fingerpri…
• CVE-2018-14993The ASUS Zenfone V Live Android device with a build fingerpr…
• CVE-2018-14994The Essential Phone Android device with a build fingerprint …
• CVE-2018-14995The ZTE Blade Vantage Android device with a build fingerprin…
• CVE-2018-14996The Oppo F5 Android device with a build fingerprint of OPPO/…
• CVE-2018-14998The Leagoo P1 Android device with a build fingerprint of sp7…
• CVE-2018-14999The Leagoo P1 device with a build fingerprint of sp7731c_1h1…
• CVE-2018-15000The Vivo V7 Android device with a build fingerprint of vivo/…
• CVE-2018-15001The Vivo V7 Android device with a build fingerprint of vivo/…
• CVE-2018-15002The Vivo V7 device with a build fingerprint of vivo/1718/171…
• CVE-2018-15003The Coolpad Defiant (Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/09…