CVE-2026-110618

8.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-306

Impact

Adjacent network attackers can read call logs, contacts, and SMS messages, send SMS, or overwrite app configuration without authentication. They only need network reachability to the exposed AndServer HTTP service.

Root cause

The built-in AndServer HTTP server exposes remote-control and cloning API endpoints without enforcing authentication checks.

Affected systems

SmsForwarder through 3.5.0

CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

No patched version is specified; disable the embedded HTTP server in the SmsForwarder app settings or block network access to its listening port immediately.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110618