CVE-2026-110618 in SmsForwarder
Summary
by MITRE • 10/14/2026
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in SmsForwarder versions through 3.5.0 stems from a critical misconfiguration within its embedded AndServer HTTP server component. This flaw manifests as a missing authentication mechanism for several default-enabled remote control endpoints, effectively creating an unauthenticated access vector that can be exploited by any network attacker with connectivity to the affected device or service. The core technical issue lies in the failure to enforce identity verification before processing requests directed at sensitive management interfaces, allowing external actors to interact directly with the application's backend logic without providing valid credentials.
From a technical perspective, the AndServer implementation exposes specific API endpoints that are intended for administrative control but lack necessary access controls. These endpoints facilitate high-privilege operations such as reading personal data including SMS messages, call logs, and contact lists, which constitute sensitive user information. Furthermore, the vulnerability permits attackers to send SMS messages from the device, potentially facilitating phishing campaigns or spam distribution. The most severe aspect of this flaw involves the clone API functionality, which allows for the exportation of application configuration files as well as their overwriting by remote actors. This capability enables an attacker to completely reconfigure the forwarding rules and settings of the SmsForwarder application without authorization.
The operational impact of this vulnerability is significant due to the nature of the data accessible through these endpoints. The ability to read SMS, call logs, and contacts represents a severe compromise of user privacy and confidentiality, exposing sensitive personal communications and social graphs to unauthorized parties. Additionally, the capacity to send SMS messages transforms the compromised device into an active tool for malicious activities, such as sending fraudulent verification codes or spam content that can damage the reputation of the victim's phone number. The ability to export configurations allows attackers to harvest security settings and forwarding rules, while overwriting these configurations enables persistent control over how future communications are handled, potentially redirecting sensitive messages like two-factor authentication codes to attacker-controlled numbers for account takeover attacks.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as the system fails to adequately verify the identity of users attempting to access restricted resources. In terms of threat modeling and attack patterns, this scenario corresponds to MITRE ATT&CK techniques involving Initial Access through exploitation of application vulnerabilities and subsequent actions such as Collection for data harvesting and Command and Control if used for persistent remote management. The lack of authentication on these specific endpoints also reflects CWE-862, Missing Authorization, where the system does not enforce proper access control policies after a user has been authenticated or in this case, when no authentication is required at all.
To mitigate this risk, users should immediately upgrade to SmsForwarder version 3.5.1 or later, where these default-enabled endpoints have likely had their security posture improved through the implementation of mandatory authentication checks. For environments running older versions that cannot be updated immediately, it is advisable to disable remote control features entirely if they are not strictly necessary for operation. Network-level mitigations such as restricting access to the application's port via firewall rules or placing the service behind a reverse proxy with strict access control lists can also reduce exposure. Additionally, security audits should verify that no other default-enabled administrative interfaces lack proper authentication mechanisms in similar embedded server implementations within mobile applications.