Arbitrary Command Execution in Oppo F5 Leading to Sensitive Data Exposure

CVE-2018-14996

What is CVE-2018-14996?

A pre-installed application on the Oppo F5 Android device exposes a serious vulnerability that enables apps with zero permissions to execute arbitrary commands as the system user. This security loophole allows potential attackers to access sensitive user data, including the ability to record the user’s screen and audio surreptitiously, reset the device, and intercept personal messages. The issue arises from the exported service of the vulnerable app, which cannot be disabled by users, presenting a significant threat to user privacy and device integrity.

References