CVE-2018-16618
Status: ModifiedCritical (9.8)—
Severity9.8Critical · CVSS 3.0
Exploitation probability8.03 %higher than 95% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name. It exposes the storeintenttranslate.x service on port 1668 listening for requests on localhost. Requests submitted to this service are checked for a string of random characters followed by the name of an Android activity to start. Activities are started by inserting their name into a string that is executed in a shell command. By inserting metacharacters this can be exploited to run arbitrary commands as root.
Read full descriptionShow less
The requests also match those of the HTTP protocol and can be triggered on any web page rendered on the device by requesting resources stored at an http://127.0.0.1:1668/ URI, as demonstrated by the http://127.0.0.1:1668/dacdb70556479813fab2d92896596eef?';{ping,example.org}' URL.
CVSS
- Base score
- 9.8
- Version
- 3.0
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 8.03 %
- Percentile among all scored CVEs
- 95
- Score date
- 10/21/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-78
References
Raw JSON (NVD)
Show
{
"id": "CVE-2018-16618",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2019-06-19T18:15:10.853",
"references": [
{
"url": "https://www.surecloud.com/sc-blog/vtech",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.vtech.com/en/our-businesses/product-support/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.surecloud.com/sc-blog/vtech",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.vtech.com/en/our-businesses/product-support/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name. It exposes the storeintenttranslate.x service on port 1668 listening for requests on localhost. Requests submitted to this service are checked for a string of random characters followed by the name of an Android activity to start. Activities are started by inserting their name into a string that is executed in a shell command. By inserting metacharacters this can be exploited to run arbitrary commands as root. The requests also match those of the HTTP protocol and can be triggered on any web page rendered on the device by requesting resources stored at an http://127.0.0.1:1668/ URI, as demonstrated by the http://127.0.0.1:1668/dacdb70556479813fab2d92896596eef?';{ping,example.org}' URL."
},
{
"lang": "es",
"value": "VTech Storio Max antes de 56.D3JM6 permite la ejecución remota de comandos a través de metacaracteres de shell en un nombre de actividad de Android. Expone el servicio storeintenttranslate.x en el puerto 1668 que escucha las solicitudes en localhost. Las solicitudes enviadas a este servicio se verifican para una serie de caracteres aleatorios seguidos por el nombre de una actividad de Android para comenzar. Las actividades se inician insertando su nombre en una cadena que se ejecuta en un comando de shell. Al insertar metacaracteres, esto puede ser explotado para ejecutar comandos arbitrarios como root. Las solicitudes también coinciden con las del protocolo HTTP y pueden activarse en cualquier página web representada en el dispositivo solicitando recursos almacenados en una URI http://127.0.0.1:1668/, como lo demuestra la http://127.0.0.1 : 1668 / dacdb70556479813fab2d92896596eef? '; {Ping, example.org}' URL"
}
],
"lastModified": "2026-06-17T01:44:33.283",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:vtech:storio_max_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28FC9573-A2E3-4543-9156-8B6242059FDA",
"versionEndExcluding": "56.d3jm6"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:vtech:80-183803:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "043A6115-1C5F-43A8-B93D-19483A3199A7"
},
{
"criteria": "cpe:2.3:h:vtech:80-183804:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "03405DE1-B859-4261-BD75-E3387583E814"
},
{
"criteria": "cpe:2.3:h:vtech:80-183805:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "920C0E4F-D0CC-42CC-AC41-652080E8837C"
},
{
"criteria": "cpe:2.3:h:vtech:80-183807:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F6A0D5C0-34B9-4621-BBC9-49E40CF772BE"
},
{
"criteria": "cpe:2.3:h:vtech:80-183822:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6795FA5E-0304-413C-ABD0-3629A81B695D"
},
{
"criteria": "cpe:2.3:h:vtech:80-183823:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "74036CF5-80E2-46E5-9082-AD6126A47CAD"
},
{
"criteria": "cpe:2.3:h:vtech:80-183824:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B96E2A61-E954-4572-B5A1-C4D68DDC9D71"
},
{
"criteria": "cpe:2.3:h:vtech:80-1838xx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "099E1B36-3767-4982-B894-4A6055147235"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}