[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYo3IQH0g7dZxrG4c87e5YWF3t-40VQ60k1A9zDoDktE":3,"g5a-risk:CVE-2018-15004":116},{"success":4,"data":5,"meta":114},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":15,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":51,"references":52,"referencesCount":51,"weaknesses":62,"weaknessesCount":71,"isActivelyExploited":72,"cisaInfo":15,"otxData":15,"relatedBlogPosts":73,"seoMetadata":74,"configurations":99,"relatedVendorCves":112,"notableEvents":113},"CVE-2018-15004","What is CVE-2018-15004?","The Coolpad Canvas device with a build fingerprint of Coolpad\u002Fcp3636a\u002Fcp3636a:7.0\u002FNRD90M\u002F093031423:user\u002Frelease-keys contains a platform app with a package name of com.qualcomm.qti.modemtestmode (versionCode=24, versionName=7.0) that contains an exported service app component named com.qualcomm.qti.modemtestmode.MbnTestService that allows any app on the device to set certain system properties as the com.android.phone user. When an app sets the persist.service.logr.enable system property to a value of 1, an app with a package name of com.yulong.logredirect (versionCode=20160622, versionName=5.25_20160622_01) will start writing the system-wide logcat log, kernel log, and a tcpdump network traffic capture to external storage. Furthermore, on the Coolpad Canvas device, the com.android.phone app writes the destination phone number and body of the text message for outgoing text messages. A notification when logging can be avoided if the log is enabled after device startup and disabled prior to device shutdown by setting the system properties using the exported interface of the com.qualcomm.qti.modemtestmode app. Any app with the READ_EXTERNAL_STORAGE permission can access the log files.","The Coolpad Canvas device with a build fingerprint of Coolpad\u002Fcp3636a\u002Fcp3636a:7.0\u002FNRD90M\u002F093031423:user\u002Frelease-keys contains a platform app with a package n...","2018-12-28T21:29:00.9","2019-02-07T17:34:43.057",5.9,"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":16,"CVSSMetricV2":29,"CVSSMetricV40":15},null,[17],{"Source":18,"Type":19,"CVSSData":20,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":21,"VectorString":13,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":23,"IntegrityImpact":24,"AvailabilityImpact":24,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"TemporalSeverity":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"ModifiedAttackVector":15,"ModifiedAttackComplexity":15,"ModifiedPrivilegesRequired":15,"ModifiedUserInteraction":15,"ModifiedScope":15,"ModifiedConfidentialityImpact":15,"ModifiedIntegrityImpact":15,"ModifiedAvailabilityImpact":15,"EnvironmentalScore":15,"EnvironmentalSeverity":15},"3.0","NETWORK","HIGH","NONE","UNCHANGED","MEDIUM",2.2,3.6,[30],{"Source":18,"Type":19,"CVSSData":31,"BaseSeverity":26,"ExploitabilityScore":36,"ImpactScore":37,"ACInsufInfo":15,"ObtainAllPrivilege":15,"ObtainUserPrivilege":15,"ObtainOtherPrivilege":15,"UserInteractionRequired":15},{"Version":32,"VectorString":33,"AccessVector":22,"AccessComplexity":26,"Authentication":24,"ConfidentialityImpact":34,"IntegrityImpact":24,"AvailabilityImpact":24,"BaseScore":35,"BaseSeverity":15,"Exploitability":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"CollateralDamagePotential":15,"TargetDistribution":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"EnvironmentalScore":15},"2.0","AV:N\u002FAC:M\u002FAu:N\u002FC:P\u002FI:N\u002FA:N","PARTIAL",4.3,8.6,2.9,0.01084,[38,38,38,38,38,38,38],"Medium",[42,47],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"coolpad","canvas_firmware","7.0","cpe:2.3:o:coolpad:canvas_firmware:7.0:*:*:*:*:*:*:*",{"vendor":43,"product":48,"version":49,"criteria":50,"vulnerable":4},"canvas","-","cpe:2.3:h:coolpad:canvas:-:*:*:*:*:*:*:*",2,[53,59],{"url":54,"source":55,"tags":56},"https:\u002F\u002Fwww.kryptowire.com\u002Fportal\u002Fandroid-firmware-defcon-2018\u002F","Kryptowire",[57,58],"Exploit","Third Party Advisory",{"url":60,"source":55,"tags":61},"https:\u002F\u002Fwww.kryptowire.com\u002Fportal\u002Fwp-content\u002Fuploads\u002F2018\u002F12\u002FDEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf",[57,58],[63],{"id":64,"name":65,"description":66,"extendedDescription":67,"status":68,"abstraction":69,"structure":70},"CWE-532","Insertion of Sensitive Information into Log File","Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.","While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers.\nDifferent log files may be produced and stored for:","Incomplete","Base","Simple",1,false,[],{"title":75,"metaDescription":76,"keywords":77,"canonicalUrl":78,"structuredData":79},"What is CVE-2018-15004? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2018-15004, a medium severity cyber security vulnerability from 2018. The Coolpad Canvas device with a build fingerprint of Coo...","CVE-2018-15004, CVE-2018-15004 vulnerability, CVE-2018-15004 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2018, CVSS score, exploit, patch, remediation, coolpad security, canvas_firmware vulnerability, canvas vulnerability","\u002Fwhat-is\u002Fcve-2018-15004",{"@context":80,"@type":81,"headline":75,"description":76,"datePublished":10,"dateModified":11,"author":82,"publisher":86,"about":90,"mainEntityOfPage":94,"articleSection":97,"keywords":98},"https:\u002F\u002Fschema.org","TechArticle",{"@type":83,"name":84,"url":85},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":83,"name":84,"url":85,"logo":87},{"@type":88,"url":89},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":91,"name":6,"description":92,"additionalType":93},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":95,"@id":96},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2018-15004","Cybersecurity","CVE-2018-15004, CVE-2018-15004 vulnerability, CVE-2018-15004 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[100],{"Operator":101,"Negate":15,"Nodes":102},"AND",[103,108],{"Operator":104,"Negate":15,"CPEMatch":105},"OR",[106],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":107,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"D74BC097-CE81-4C08-B519-C4D3D1BA8FD3",{"Operator":104,"Negate":15,"CPEMatch":109},[110],{"Vulnerable":15,"Criteria":50,"MatchCriteriaID":111,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"5A93A3B7-A7FC-49B4-A2A2-2DA9CE5D8365",[],[],{"lastModified":11,"cacheTime":115,"version":32},1792375351205,{"score":117,"band":40,"action":118,"scoredAt":119},42,"Plan remediation","2026-10-16T06:45:21.198644+00:00"]