CVE-2018-6598 : Security Advisory and Response

A vulnerability has been identified in devices with the model Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys. Any application installed on the device has the ability to send a command to reset the device to its factory settings through the com.android.server.MasterClearReceiver component. This action can be performed without any user intervention or permission. Resetting the device to factory settings will erase all user data, potentially resulting in the loss of any data that has not been backed up or synchronized externally. It is important to note that this capability is not directly available to third-party apps that are downloaded by the user, but rather through an unprotected component of the Android OS. This vulnerability is not present in the Android Open Source Project (AOSP) code released by Google, indicating that it was introduced either by Orbic or another entity involved in the supply chain.

Understanding CVE-2018-6598

This CVE entry describes a critical vulnerability that allows any app on the affected device to trigger a factory reset without user interaction, leading to potential data loss.

What is CVE-2018-6598?

The vulnerability in Orbic Wonder Orbic/RC555L/RC555L devices enables any installed application to initiate a factory reset without user consent, potentially causing data loss.

The Impact of CVE-2018-6598

Unauthorized factory reset capability through an Android OS component
Risk of data loss due to the erasure of user data
Not directly accessible to third-party apps but present in the device's OS

Technical Details of CVE-2018-6598

This section provides detailed technical insights into the vulnerability.

Vulnerability Description

Any app on the device can trigger a factory reset via com.android.server.MasterClearReceiver
No user interaction or permission is required
Data loss risk as all user data is erased

Affected Systems and Versions

Device: Orbic Wonder Orbic/RC555L/RC555L
Android Version: 7.1.2/N2G47H/329100b:user/release-keys

Exploitation Mechanism

Exploitation involves sending an intent to factory reset the device programmatically
The vulnerability lies in an unprotected component of the Android OS

Mitigation and Prevention

Protect your device and data by following these mitigation steps.

Immediate Steps to Take

Avoid installing unknown or untrusted applications
Regularly back up important data externally
Be cautious while granting permissions to apps

Long-Term Security Practices

Keep your device's OS and applications up to date
Implement device encryption for added security
Use reputable app sources to minimize risks

Patching and Updates

Check for security updates from the device manufacturer
Apply patches promptly to address known vulnerabilities