CVE-2018-14993 : Security Advisory and Response

The ASUS Zenfone V Live and Asus ZenFone 3 Max Android devices are affected by a vulnerability that allows a third-party app to execute arbitrary commands as the system user, potentially compromising user data and device functionality.

Understanding CVE-2018-14993

This CVE describes a security issue in the pre-installed platform app on the mentioned ASUS Android devices.

What is CVE-2018-14993?

The vulnerability in the com.asus.splendidcommandagent app allows unauthorized apps to execute commands as the system user, leading to various privacy and security risks.

The Impact of CVE-2018-14993

The exploit could enable malicious apps to perform actions like screen recording, factory resetting, accessing notifications, injecting events in the GUI, and more, compromising user privacy and device integrity.

Technical Details of CVE-2018-14993

The technical aspects of the vulnerability are crucial to understanding its implications.

Vulnerability Description

The vulnerable app on the ASUS devices allows arbitrary command execution by unauthorized apps, posing severe security risks.

Affected Systems and Versions

ASUS Zenfone V Live with build fingerprint asus/VZW_ASUS_A009/ASUS_A009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/release-keys
Asus ZenFone 3 Max with build fingerprint asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys

Exploitation Mechanism

The vulnerability allows any co-located app on the device to supply commands that can be executed as the system user, even by zero-permission apps.

Mitigation and Prevention

Taking immediate steps and implementing long-term security practices are essential to mitigate the risks posed by CVE-2018-14993.

Immediate Steps to Take

Avoid installing apps from untrusted sources
Regularly monitor app permissions and revoke unnecessary ones
Update the device firmware and security patches

Long-Term Security Practices

Keep the device OS up to date
Use reputable security apps to scan for vulnerabilities
Be cautious of app permissions and behavior

Patching and Updates

Check for and apply firmware updates provided by ASUS to address the vulnerability