How severe is CVE-2018-14992?

CVE-2018-14992 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2018-14992 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-14992?

CVE-2018-14992 affects Asus Zenfone 3 Max Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-14992?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2018-14992 published?

CVE-2018-14992 was published on 2018-12-28 and last updated on 2026-06-17.

CVE-2018-14992

CVE-2018-14992 is a medium-severity vulnerability in Asus Zenfone 3 Max Firmware with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 2.1
EPSS exploit prediction: 0% (29th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Asus Zenfone 3 Max Firmware
Published: 2018-12-28
Last modified: 2026-06-17

Description

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm (versionCode=1510500200, versionName=1.5.0.40_171122) has an exposed interface in an exported service named com.asus.dm.installer.DMInstallerService that allows any app co-located on the device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device can send an intent with specific embedded data that will cause the com.asus.dm app to programmatically download and install the app. For the app to be downloaded and installed, certain data needs to be provided: download URL, package name, version name from the app's AndroidManifest.xml file, and the MD5 hash of the app. Moreover, any app that is installed using this method can also be programmatically uninstalled using the same unprotected component named com.asus.dm.installer.DMInstallerService.

Frequently asked questions

What is CVE-2018-14992?: The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm (versionCode=1510500200, versionName=1.5.0.40_171122) has an exposed interface in an exported service named com.asus.dm.installer.DMInstallerService that allows any app co-located on the device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device can send an intent with specific embedded data that will cause the com.asus.dm app to programmatically download and install the app. For the app to be downloaded and installed, certain data needs to be provided: download URL, package name, version name from the app's AndroidManifest.xml file, and the MD5 hash of the app. Moreover, any app that is installed using this method can also be programmatically uninstalled using the same unprotected component named com.asus.dm.installer.DMInstallerService.
How severe is CVE-2018-14992?: CVE-2018-14992 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2018-14992 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-14992?: CVE-2018-14992 affects Asus Zenfone 3 Max Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-14992?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-14992 published?: CVE-2018-14992 was published on 2018-12-28 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:asus:zenfone_3_max_firmware:1.5.0.40:*:*:*:*:*:*:*

More vulnerabilities in Asus Zenfone 3 Max Firmware

CVE-2018-14993 — High (CVSS 7.8): The ASUS Zenfone V Live Android device with a build fingerprint of…
CVE-2018-14980 — High (CVSS 7.1): The ASUS ZenFone 3 Max Android device with a build fingerprint of…
CVE-2018-14979 — Medium (CVSS 4.7): The ASUS ZenFone 3 Max Android device with a build fingerprint of…

All CVEs affecting Asus Zenfone 3 Max Firmware →