CVE-2018-15005

Vulnerability

The ZTE ZMAX Champ (build fingerprint ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys) includes a pre-installed platform app with package name com.zte.zdm.sdm (versionCode=31, versionName=V5.0.3). This app contains an exported broadcast receiver component named com.zte.zdm.VdmcBroadcastReceiver that can be triggered by any co-located app without requiring any permissions. The receiver initiates a factory reset of the device. This vulnerability affects the specific device and software version as identified in the advisory [1][2].

Exploitation

An attacker needs only to have any app installed on the device. The attacking app does not require any special permissions. By sending an intent to the exported broadcast receiver com.zte.zdm.VdmcBroadcastReceiver, the attacker can programmatically initiate a factory reset. No user interaction is required beyond the installation of the malicious app. The capability to perform a factory reset is not normally available to third-party apps except through Mobile Device Management (MDM) apps, but this vulnerability exposes it without restriction.

Impact

Successful exploitation results in a factory reset, which removes all user data and applications from the device. This leads to permanent loss of any data not backed up or synced externally. The impact is a denial of service and data loss, affecting the confidentiality, integrity, and availability of user data.

Mitigation

No official fix has been published by ZTE as of the disclosure date. Users should regularly back up important data and exercise caution when installing third-party apps. Mobile Device Management (MDM) solutions may be configured to block apps that attempt to use this vulnerable component. The vulnerability was identified through research presented at DEF CON 26 [1][2]. Users may consider disabling or uninstalling the pre-installed app if possible, though this may not be feasible on all devices.