CVE-2016-10137
CVE-2016-10137 is a high-severity vulnerability in Adups Adups Fota with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-310.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- CVSS v2: 7.2
- EPSS exploit prediction: 0% (27th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-310
- Affected product: Adups Adups Fota
- Published:
- Last modified:
Description
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.
Frequently asked questions
- What is CVE-2016-10137?
- An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.
- How severe is CVE-2016-10137?
- CVE-2016-10137 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2016-10137 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2016-10137?
- CVE-2016-10137 affects Adups Adups Fota. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2016-10137?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2016-10137 published?
- CVE-2016-10137 was published on 2017-01-13 and last updated on 2026-06-17.
References
- http://www.securityfocus.com/bid/96852
- https://www.kryptowire.com/adups_security_analysis.html
- https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html
Affected products (1)
- cpe:2.3:a:adups:adups_fota:-:*:*:*:*:*:*:*
More vulnerabilities in Adups Adups Fota
- CVE-2016-10139 — High (CVSS 7.8): An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the…
- CVE-2016-10138 — High (CVSS 7.8): An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The…
- CVE-2016-10136 — High (CVSS 7.8): An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named…
All CVEs affecting Adups Adups Fota →
Other CWE-310 (Cryptographic Issues) vulnerabilities
- CVE-2014-7878 — Critical (CVSS 10.0): The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived…
- CVE-2013-3712 — Critical (CVSS 10.0): SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has…
- CVE-2013-6952 — Critical (CVSS 10.0): The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote…
- CVE-2013-6838 — Critical (CVSS 10.0): An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000)…
- CVE-2013-0137 — Critical (CVSS 10.0): The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189…
- CVE-2011-5123 — Critical (CVSS 10.0): The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not check whether X.509 certificates in…