{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/smsforwarder--3.5.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:smsforwarder_project:smsforwarder:*:*:*:*:*:android:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-110618"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SmsForwarder (\u003c= 3.5.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","mobile","authentication-bypass"],"_cs_type":"threat","_cs_vendors":["SmsForwarder"],"content_html":"\u003cp\u003eSmsForwarder through version 3.5.0 is vulnerable to a missing authentication flaw within its embedded AndServer HTTP server component. This vulnerability allows an unauthenticated network-adjacent attacker to reach sensitive remote-control API endpoints that are enabled by default. By communicating directly with the application over the network, an attacker can perform high-impact actions, including reading SMS messages, accessing call logs, extracting contact information, and sending arbitrary SMS messages. Furthermore, the vulnerability exposes a 'clone' API that enables attackers to export or overwrite the application configuration. This impact is significant for environments where SmsForwarder is used to bridge messaging services or automate communication, as the exposed functionality effectively grants an attacker full control over the mobile device's communication capabilities.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a severe risk of data exfiltration and unauthorized command execution for users of SmsForwarder. Attackers can monitor private communications, spoof legitimate messages, and gain persistence or modify the application behavior by overwriting configurations. This is particularly dangerous for enterprise users relying on the software for secure SMS forwarding or secondary authentication channels, where interception or manipulation could lead to account takeovers or sensitive data leaks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade SmsForwarder to a version beyond 3.5.0 immediately to address the insecure AndServer implementation.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the mobile device running SmsForwarder, ensuring that the port used by the AndServer component is not exposed to untrusted or public networks.\u003c/li\u003e\n\u003cli\u003eAudit mobile device firewall settings and application permissions to identify and isolate instances of SmsForwarder exposed to network segments accessible by unauthorized third parties.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:36:48Z","date_published":"2026-10-14T16:36:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-smsforwarder-auth-bypass/","summary":"SmsForwarder through version 3.5.0 contains a missing authentication vulnerability in its embedded AndServer HTTP server, allowing attackers to remotely control the application and access sensitive data.","title":"Unauthenticated Remote API Access in SmsForwarder","url":"https://feed.craftedsignal.io/briefs/2026-10-smsforwarder-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - SmsForwarder (\u003c= 3.5.0)","version":"https://jsonfeed.org/version/1.1"}