CVE-2025-10184
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-10184. We'll provide specific mitigation strategies based on your environment and risk profile.
Description
The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks.
The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers.
Available Exploits
Related News
EU Vulnerability Database
Monitored by ENISA for EU cybersecurity
ENISA Analysis
Malicious code in bioql (PyPI)
Affected Products (ENISA)
ENISA Scoring
CVSS Score (4.0)
EPSS Score
ENISA References
Data provided by ENISA EU Vulnerability Database. Last updated: October 3, 2025
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
Advisory provided by GitHub Security Advisory Database. Published: September 23, 2025, Modified: September 23, 2025
Social Media Intelligence
Real-time discussions and threat intelligence from social platforms
CVE-2025-10184 Analysis: OnePlus OxygenOS SMS vulnerability - Negligence or intentional design? **TL;DR:** OnePlus implemented three custom ContentProviders in OxygenOS 12+ that expose SMS/MMS data without proper permission enforcement. After technical analysis of the implementation, the design choices raise questions about intent vs. negligence. **Background:** Rapid7 disclosed CVE-2025-10184 last week - …
Is the OnePlus 12 (CPH2581_15.0.0.860/EX01V80P01) affected by the CVE-2025-10184 SMS vulnerability? Hey everyone, I just read about the major SMS vulnerability (CVE-2025-10184) that was recently disclosed affecting OxygenOS 12+ devices. According to the security research from Rapid7, this vulnerability allows malicious apps to access SMS/MMS messages without user permission, which …
ColorOS(6.0.1-current)/OxygenOS (12-15)/RealmeUI vulnerability Any app can read SMS data without user permission in this vulnerability. Read this: https://github.com/yuuouu/ColorOS-CVE-2025-10184
ColorOS(6.0.1-current)/OxygenOS(12-15)/RealmeUI vulnerability Any app can read SMS data without user permission in this vulnerability. Read this: https://github.com/yuuouu/ColorOS-CVE-2025-10184
ColorOS(6.0-current)/OxygenOS(12-15)/RealmeUI SMS vulnerability Any app can read SMS data without user permission in this vulnerability. Read this: https://github.com/yuuouu/ColorOS-CVE-2025-10184
🔥 Top 10 Trending CVEs (29/09/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-24085](https://nvd.nist.gov/vuln/detail/CVE-2025-24085)** - 📝 A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, …
OnePlus smartphones vulnerable to SMS hacking risks **Date:** 27-Sep-25 A critical security vulnerability affecting OnePlus smartphones running OxygenOS versions 12 to 15 has been identified, allowing malicious apps to read and send SMS messages without user permission. Tracked as CVE-2025-10184, this flaw risks exposing sensitive information, including two-factor authentication codes, …
🔥 Top 10 Trending CVEs (26/09/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-20333](https://nvd.nist.gov/vuln/detail/CVE-2025-20333)** - 📝 A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, …
A major security flaw in OnePlus phones could let rogue apps read and send SMS messages, potentially exposing your 2FA codes Researchers from Rapid7 uncovered a permission bypass bug (CVE-2025-10184) in multiple OxygenOS versions that allows any installed app to read SMS/MMS data and metadata without needing permission. It also …