CVE-2018-14986

🗓️ 28 Dec 2018 21:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 42 Views🌐 WEB

The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed app with a package name of com.android.messaging (versionCode=1000110, versionName=1.0.001, (android.20170630.092853-0)) containing an exported content provider named com.android.messaging.datamodel.MessagingContentProvider

Reporter	Title	Published	Views	Family All 4
Cvelist	CVE-2018-14986	28 Dec 201821:00	–	cvelist
EUVD	EUVD-2018-6868	7 Oct 202500:30	–	euvd
NVD	CVE-2018-14986	28 Dec 201821:29	–	nvd
Prion	Design/Logic Flaw	28 Dec 201821:29	–	prion

NVD

Node

leagoo z5c_firmwareMatch-

AND

leagoo z5cMatch-

Source	Link
kryptowire	www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf
kryptowire	www.kryptowire.com/portal/android-firmware-defcon-2018/

Parameter	Position	Path	Description	CWE
body	path	content://com.android.messaging.datamodel.MessagingContentProvider	Exported messaging content provider allows any app to read the most recent text message per conversation without permissions.	CWE-200
phone_number	path	content://com.android.messaging.datamodel.MessagingContentProvider	Exported messaging content provider allows any app to read the most recent text message per conversation without permissions.	CWE-200
name	path	content://com.android.messaging.datamodel.MessagingContentProvider	Exported messaging content provider allows any app to read the most recent text message per conversation without permissions.	CWE-200
timestamp	path	content://com.android.messaging.datamodel.MessagingContentProvider	Exported messaging content provider allows any app to read the most recent text message per conversation without permissions.	CWE-200

17 Jun 2026 01:42Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 37.5

EPSS0.01247

CWE-200