Unauthenticated Remote API Access in SmsForwarder

Executive Summary

CVE-2026-110618 is a missing authentication vulnerability in SmsForwarder through version 3.5.0. It allows unauthenticated network attackers to remotely invoke critical APIs without any credentials. Attackers can exploit default-enabled endpoints to read SMS messages, call logs, contacts, send SMS, export or overwrite configurations, and perform other sensitive actions.

Useful 0 Not Useful 0

Detection Guidance

Check if SmsForwarder's HTTP server is running on your device by inspecting open ports. Use commands like 'netstat -tuln' or 'ss -tuln' to list listening ports. If the server is exposed on a non-loopback interface, it may be vulnerable. Test endpoints like /config/query, /sms/query, or /contact/query with curl commands such as 'curl http://<device-ip>:<port>/sms/query' to see if they return sensitive data without authentication.

Verify the app version is 3.5.0 or earlier. Check the server's security mode in the app settings; if set to 0, the server lacks authentication. Look for unusual network traffic or unauthorized data access patterns in logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers on the same network to access private data like SMS, call logs, and contacts without authorization. They can also send unauthorized SMS, modify app settings, or export sensitive configurations. The impact includes loss of confidentiality, integrity, and potential control over the device's messaging and contact data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive personal data such as SMS, call logs, and contacts. GDPR requires strict protection of personal data, while HIPAA mandates safeguards for health-related communications. The lack of authentication exposes regulated data to unauthorized parties, creating compliance risks.

Useful 0 Not Useful 0

Mitigation Strategies

Update SmsForwarder to the latest version if available. If no update exists, disable the HTTP server in the app settings or uninstall the app until a patch is released. Restrict the server to loopback interface only by modifying network settings or firewall rules to block external access.

Enable authentication in the app's security settings if supported. Change default API endpoints or disable sensitive features like remote control. Monitor network traffic for unauthorized access attempts and revoke any suspicious configurations.

Useful 0 Not Useful 0