SmsForwarder EUVD-2026-101246

Exploitation requires that SmsForwarder (version through 3.5.0) be running its AndServer-based HTTP remote-control server, whose API endpoints are default-enabled and lack any authentication check (CWE-306), so no special configuration is needed to expose them. The attacker must reach the device's HTTP listener over an adjacent network - the CVSS vector is AV:A, meaning same LAN/Wi-Fi segment or tethered/adjacent network rather than arbitrary internet reachability, which is the primary limiting factor. No credentials, user interaction, or non-default settings are required (PR:N/UI:N/AC:L); the chief mitigating conditions are the adjacent-network constraint and the need for the in-app HTTP server to be active and network-reachable.

The input provides a CVSS 4.0 vector (score 8.6) but no CVSS 3.1 vector, no EPSS score, no KEV listing, and no explicit POC flag - so several standard prioritization signals are missing and must be stated as unknown rather than assumed. The CVSS 4.0 vector is the strongest objective signal: AV:A (adjacent network, NOT full internet-wide remote), AC:L, AT:N, PR:N and UI:N indicate an unauthenticated, low-complexity attack requiring no user interaction, with high confidentiality and integrity impact (VC:H/VI:H) and no availability impact (VA:N). The critical nuance is AV:A: despite the description's phrase 'unauthenticated network attackers', the vector scopes this to an adjacent network (same LAN/Wi-Fi segment or tethered network), not arbitrary internet reachability - this materially lowers real-world exposure versus a true AV:N remote flaw and should be verified against deployment topology. There is no CISA KEV entry and no confirmed public exploit in the provided data, so per precision rules this is 'no public exploit identified at time of analysis'; however, a VulnCheck advisory plus a HackMD technical writeup and direct source-line references exist, which lowers the barrier to building an exploit even though none is confirmed public. Net: this is a genuinely high-severity design flaw (missing authentication, CWE-306, default-enabled endpoints) but the practical priority is tempered by adjacent-only reach and a niche product footprint - treat as high priority for anyone running the app on an untrusted shared network, lower priority for isolated personal deployments. EPSS and KEV are both absent, so no exploitation-probability or confirmed-in-the-wild data is available to confirm or contradict the CVSS severity.

An attacker on the same local or adjacent network (e.g., shared Wi-Fi) discovers the victim's Android device running SmsForwarder's default-enabled AndServer HTTP endpoints and, without any credentials or user interaction, issues HTTP requests to the remote-control API. They read the victim's SMS messages, call logs and contacts, send SMS from the device, and invoke the clone API to export or overwrite the app configuration. No confirmed public exploit exists, but the VulnCheck advisory and HackMD writeup document the vulnerable endpoints and source lines, making exploit development straightforward.