CVE-2026-110618
CVE-2026-110618 · SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.
CVSS 8.6 · Alta · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
smsforwarder
- Versiones
- ≥ 0, ≤ 3.5.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/H1ue_ahiMe
- https://github.com/pppscn/SmsForwarder/blob/v3.5.0/app/src/main/kotlin/cn/ppps/forwarder/utils/HttpServerUtils.kt#L35-L38
- https://github.com/pppscn/SmsForwarder/blob/v3.5.0/app/src/main/kotlin/cn/ppps/forwarder/server/component/AppMessageConverter.kt#L93-L96
- https://github.com/pppscn/SmsForwarder
- https://www.vulncheck.com/advisories/smsforwarder-through-3.5.0-missing-authentication-in-http-server-remote-control-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-110618