Read the docs
TI-2018-10798 Aliases CVE-2018-14992GHSA-cp3m-3jjq-r3cg

The ASUS ZenFone 3 Max Android device with a build fingerprint of…

Priority LOW 25Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm (versionCode=1510500200, versionName=1.5.0.40_171122) has an exposed interface in an exported service named com.asus.dm.installer.DMInstallerService that allows any app co-located on the device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device can send an intent with specific embedded data that will cause the com.asus.dm app to programmatically download and install the app. For the app to be downloaded and installed, certain data needs to be provided: download URL, package name, version name from the app's AndroidManifest.xml file, and the MD5 hash of the app. Moreover, any app that is installed using this method can also be programmatically uninstalled using the same unprotected component named com.asus.dm.installer.DMInstallerService.

Why it matters now

EPSS 0.00365 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:asus:zenfone_3_max_firmware:1.5.0.40:*:*:*:*:*:*:*1.5.0.40VulnerableASUS
cpe:2.3:h:asus:zenfone_3_max:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
  • cpe:2.3:o:asus:zenfone_3_max_firmware:1.5.0.40:*:*:*:*:*:*:* Versions 1.5.0.40 Vulnerable ·ASUS
  • cpe:2.3:h:asus:zenfone_3_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-14992
  2. 2026-10-03 Alias added: GHSA-cp3m-3jjq-r3cg

References

Exploit 1

Advisory 1

  • TI-2018-10799 The ASUS Zenfone V Live Android device with a build fingerprint of… CVSS 3.0HIGH 7.8
  • TI-2018-10786 The ASUS ZenFone 3 Max Android device with a build fingerprint of… CVSS 3.0HIGH 7.1
  • TI-2018-10785 The ASUS ZenFone 3 Max Android device with a build fingerprint of… CVSS 3.0MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences