CVE-2018-14999

The Leagoo P1 device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform…

published April 25, 2019

CVSS
—
EPSS
2%
Percentile
83.5
In the wild
Unconfirmed
What it is

🚨 A factory reset can be triggered by any app on the Leagoo P1 device, and it doesn’t even require permissions! 🔥 Think of it like a hotel where any guest can access the master key — with just a little creativity, they could wipe everything in the room! This vulnerability could be absolutely devastating for your personal data. Any app installed on your device could initiate a factory reset, leading to the complete loss of all your files, photos, and apps that aren’t backed up. Imagine waking up to find your entire digital life wiped away because a sneaky app decided to hit the reset button!

Put simply

Think of it like a hotel where any guest can access the master key — with just a little creativity, they could wipe everything in the room! The Leagoo P1 includes a platform app with an exposed broadcast receiver that allows any co-located app to kick off a factory reset without needing permissions. This means that apps on your device can wipe it clean, exploiting this vulnerability without your knowledge.

What to do

This vulnerability could be absolutely devastating for your personal data. Any app installed on your device could initiate a factory reset, leading to the complete loss of all your files, photos, and apps that aren’t backed up. Imagine waking up to find your entire digital life wiped away because a sneaky app decided to hit the reset button! To secure your device, check for any firmware updates from the manufacturer that address this issue. If possible, remove any suspicious or untrusted apps from your device, and regularly back up your data to prevent loss. Stay vigilant about the apps you install! You can handle this! By following these steps, you'll be on your way to protecting your data like a pro! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02341 · 83.5th percentile
Published
2019-04-25T19:35Z
EPSS history
Timeline
  • 25 APR 19:35Z
    The Leagoo P1 device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform…
    cvelistv5