CVEvulnerability
CVE-2016-10137
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-01-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-310
Description
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.
Affected configurations
• adups adups fota
Related
Weakness · not in database (1)
References
- http://www.securityfocus.com/bid/96852 www.securityfocus.com
- https://www.kryptowire.com/adups_security_analysis.html Technical Description, Third Party Advisory
- https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html Press/Media Coverage
- http://www.securityfocus.com/bid/96852 www.securityfocus.com
- https://www.kryptowire.com/adups_security_analysis.html Technical Description, Third Party Advisory
- https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html Press/Media Coverage