Read the docs
TI-2018-10806 Aliases CVE-2018-15000GHSA-r85j-p62h-x482

The Vivo V7 Android device with a build fingerprint of…

Priority LOW 28Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name of com.vivo.smartshot (versionCode=1, versionName=3.0.0). This app contains an exported service named com.vivo.smartshot.ui.service.ScreenRecordService that will record the screen for 60 minutes and write the mp4 file to a location of the user's choosing. Normally, a recording notification will be visible to the user, but we discovered an approach to make it mostly transparent to the user by quickly removing a notification and floating icon. The user can see a floating icon and notification appear and disappear quickly due to quickly stopping and restarting the service with different parameters that do not interfere with the ongoing screen recording. The screen recording lasts for 60 minutes and can be written directly to the attacking app's private directory.

Why it matters now

EPSS 0.00359 29th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:vivo:v7_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerablevivo
cpe:2.3:h:vivo:v7:-:*:*:*:*:*:*:*not specified by NVDRunning onvivo
  • cpe:2.3:o:vivo:v7_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·vivo
  • cpe:2.3:h:vivo:v7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·vivo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-15000
  2. 2026-10-03 Alias added: GHSA-r85j-p62h-x482

References

Advisory 3

  • TI-2018-10807 The Vivo V7 Android device with a build fingerprint of… CVSS 3.0MEDIUM 5.5
  • TI-2018-10808 The Vivo V7 device with a build fingerprint of… CVSS 3.0MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences