Smsforwarder
Monthly
SmsForwarder through 3.5.0 exposes an AndServer-based HTTP remote-control interface whose API endpoints are enabled by default and perform no authentication check, allowing anyone who can reach the device's listener on an adjacent network to read SMS messages, call logs and contacts, send SMS on the victim's behalf, and export or overwrite the app's configuration via the clone API. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) and the independent assessment agree that exploitation is unauthenticated and requires no user interaction, but is constrained to an adjacent network path such as the same LAN or Wi-Fi segment rather than arbitrary internet reachability. The vulnerability is not listed in CISA KEV and no public exploit code was identified at time of analysis; no EPSS score, no vendor CVSS 3.1 vector, and no explicit POC flag were provided, so those prioritization signals remain unknown rather than assumed.
SmsForwarder through 3.5.0 exposes an AndServer-based HTTP remote-control interface whose API endpoints are enabled by default and perform no authentication check, allowing anyone who can reach the device's listener on an adjacent network to read SMS messages, call logs and contacts, send SMS on the victim's behalf, and export or overwrite the app's configuration via the clone API. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) and the independent assessment agree that exploitation is unauthenticated and requires no user interaction, but is constrained to an adjacent network path such as the same LAN or Wi-Fi segment rather than arbitrary internet reachability. The vulnerability is not listed in CISA KEV and no public exploit code was identified at time of analysis; no EPSS score, no vendor CVSS 3.1 vector, and no explicit POC flag were provided, so those prioritization signals remain unknown rather than assumed.