Desktopsms
Monthly
DesktopSMS 1.11.0 (MrPear) exposes a local/loopback service that performs privileged SMS operations - sending messages, returning SMS-derived content, and persisting a paired identity - without any pairing confirmation, authentication, or user interaction, so any process already running on the same device can exercise the victim app's SMS permissions. Exploitation is strictly local: an attacker must first have code execution on the device (a co-installed malicious app, or ADB/loopback access), which is why the assessed vector is AV:L with PR:N and UI:N but a hard device-foothold prerequisite. Publicly available exploit code exists (a proof-of-concept client has been published), and while no confirmed active exploitation is recorded, the low complexity and absence of user interaction make this a practical post-foothold privilege-escalation primitive against the app's SMS capabilities.
DesktopSMS 1.11.0 (MrPear) exposes a local/loopback service that performs privileged SMS operations - sending messages, returning SMS-derived content, and persisting a paired identity - without any pairing confirmation, authentication, or user interaction, so any process already running on the same device can exercise the victim app's SMS permissions. Exploitation is strictly local: an attacker must first have code execution on the device (a co-installed malicious app, or ADB/loopback access), which is why the assessed vector is AV:L with PR:N and UI:N but a hard device-foothold prerequisite. Publicly available exploit code exists (a proof-of-concept client has been published), and while no confirmed active exploitation is recorded, the low complexity and absence of user interaction make this a practical post-foothold privilege-escalation primitive against the app's SMS capabilities.