CVE-2018-13895

HIGH

Qualcomm Multiple Chipsets - Improper Access Control in RCS App Content Providers

Title source: llm
STIX 2.1

Description

Due to the missing permissions on several content providers of the RCS app in its android manifest file will lead to an unprivileged access to phone in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20

References (1)

Core 1
Core References

Scores

CVSS v3 7.8
EPSS 0.0002
EPSS Percentile 6.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-284
Status published
Products (37)
qualcomm/mdm9150_firmware
qualcomm/mdm9206_firmware
qualcomm/mdm9607_firmware
qualcomm/mdm9650_firmware
qualcomm/msm8909w_firmware
qualcomm/msm8996au_firmware
qualcomm/qcs605_firmware
qualcomm/qm215_firmware
qualcomm/sd_205_firmware
qualcomm/sd_210_firmware
... and 27 more
Published May 24, 2019
Tracked Since Feb 18, 2026