CVE-2018-14984: Leagoo z5c Firmware

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed app with a package name of com.android.messaging (versionCode=1000110, versionName=1.0.001, (android.20170630.092853-0)) with an exported broadcast receiver app component named com.android.messaging.trackersender.TrackerSender. Any app co-located on the device, even one with no permissions, can send a broadcast intent with certain embedded data to the exported broadcast receiver application component that will result in the programmatic sending of a text message where the phone number and body of the text message is controlled by the attacker.

Affected products

• Leagoo z5c Firmware: affected versions not specified

Published 2018-12-28. Last modified 2026-06-17.