Read the docs
TI-2018-10790 Aliases CVE-2018-14984GHSA-r9w8-v8hh-7577

The Leagoo Z5C Android device with a build fingerprint of…

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed app with a package name of com.android.messaging (versionCode=1000110, versionName=1.0.001, (android.20170630.092853-0)) with an exported broadcast receiver app component named com.android.messaging.trackersender.TrackerSender. Any app co-located on the device, even one with no permissions, can send a broadcast intent with certain embedded data to the exported broadcast receiver application component that will result in the programmatic sending of a text message where the phone number and body of the text message is controlled by the attacker.

Why it matters now

EPSS 0.01033 63rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:leagoo:z5c_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableLeagoo
cpe:2.3:h:leagoo:z5c:-:*:*:*:*:*:*:*not specified by NVDRunning onLeagoo
  • cpe:2.3:o:leagoo:z5c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Leagoo
  • cpe:2.3:h:leagoo:z5c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Leagoo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-14984
  2. 2026-10-03 Alias added: GHSA-r9w8-v8hh-7577

References

Exploit 1

Advisory 1

  • TI-2018-10792 The Leagoo Z5C Android device with a build fingerprint of… CVSS 3.0HIGH 7.5
  • TI-2018-10791 The Leagoo Z5C Android device with a build fingerprint of… CVSS 3.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences