How severe is CVE-2018-15006?

CVE-2018-15006 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2018-15006 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-15006?

CVE-2018-15006 affects Zteusa Zte Zmax Champ Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-15006?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2018-15006 published?

CVE-2018-15006 was published on 2018-12-28 and last updated on 2026-06-17.

CVE-2018-15006

CVE-2018-15006 is a medium-severity vulnerability in Zteusa Zte Zmax Champ Firmware with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 4.9
EPSS exploit prediction: 1% (41st percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Zteusa Zte Zmax Champ Firmware
Published: 2018-12-28
Last modified: 2026-06-17

Description

The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a pre-installed platform app with a package name of com.android.zte.hiddenmenu (versionCode=23, versionName=6.0.1) that contains an exported broadcast receiver app component named com.android.zte.hiddenmenu.CommandReceiver that is accessible to any app co-located on the device. This app component, when it receives a broadcast intent with a certain action string, will write a non-standard (i.e., not defined in Android Open Source Project (AOSP) code) command to the /cache/recovery/command file to be executed in recovery mode. Once the device boots into recovery mode, it will crash, boot into recovery mode, and crash again. This crash loop will keep repeating, which makes the device unusable. There is no way to boot into an alternate mode once the crash loop starts.

Frequently asked questions

What is CVE-2018-15006?: The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a pre-installed platform app with a package name of com.android.zte.hiddenmenu (versionCode=23, versionName=6.0.1) that contains an exported broadcast receiver app component named com.android.zte.hiddenmenu.CommandReceiver that is accessible to any app co-located on the device. This app component, when it receives a broadcast intent with a certain action string, will write a non-standard (i.e., not defined in Android Open Source Project (AOSP) code) command to the /cache/recovery/command file to be executed in recovery mode. Once the device boots into recovery mode, it will crash, boot into recovery mode, and crash again. This crash loop will keep repeating, which makes the device unusable. There is no way to boot into an alternate mode once the crash loop starts.
How severe is CVE-2018-15006?: CVE-2018-15006 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2018-15006 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-15006?: CVE-2018-15006 affects Zteusa Zte Zmax Champ Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-15006?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-15006 published?: CVE-2018-15006 was published on 2018-12-28 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:zteusa:zte_zmax_champ_firmware:6.0.1:*:*:*:*:*:*:*

More vulnerabilities in Zteusa Zte Zmax Champ Firmware

CVE-2018-15005 — High (CVSS 7.1): The ZTE ZMAX Champ Android device with a build fingerprint of…
CVE-2018-14995 — Medium (CVSS 4.7): The ZTE Blade Vantage Android device with a build fingerprint of…

All CVEs affecting Zteusa Zte Zmax Champ Firmware →