The MXQ TV Box 4.4.2 Android device with a build fingerprint of…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android framework with a package name of android (versionCode=19, versionName=4.4.2-20170213) that contains an exported broadcast receiver application component that, when called, will make the device inoperable. The vulnerable component named com.android.server.SystemRestoreReceiver will write a value of --restore_system\n--locale=<localeto the /cache/recovery/command file and boot into recovery mode. During this process, it appears that when booting into recovery mode, the system partition gets formatted or modified and will be unable to boot properly thereafter. After the device wouldn't boot properly, a factory reset of the device in recovery mode does not regain properly functionality of the device. The com.android.server.SystemRestoreReceiver broadcast receiver app component is accessible to any app co-located on the device and does not require any permission to access. The user can most likely recover the device by flashing clean firmware images placed on an SD card.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mxq_project:mxq_tv_box_firmware:4.4.2:*:*:*:*:*:*:* | 4.4.2 | Vulnerable | Mxq Project |
| cpe:2.3:h:mxq_project:mxq_tv_box:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mxq Project |
- cpe:2.3:o:mxq_project:mxq_tv_box_firmware:4.4.2:*:*:*:*:*:*:* Versions 4.4.2 Vulnerable ·Mxq Project
- cpe:2.3:h:mxq_project:mxq_tv_box:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mxq Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-14988
- 2026-10-03 Alias added: GHSA-6p3f-mx85-7g25
References
More Mxq Project Mxq Tv Box Firmware vulnerabilities
- TI-2018-10793 The MXQ TV Box 4.4.2 Android device with a build fingerprint of… CVSS 3.0HIGH 7.1
Sources
- CVE-2018-14988 · CVE Program
- CVE-2018-14988 · NVD
- FIRST EPSS
- GHSA-6p3f-mx85-7g25 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences