SmsForwarder: Missing authentication in HTTP remote control API

Summary

SmsForwarder through version 3.5.0, an Android app that forwards SMS and call notifications, contains an embedded HTTP server (AndServer) whose remote-control endpoints do not require authentication. The vulnerability is enabled by default, so an unauthenticated network attacker who can reach the app's port can read SMS, call logs and contacts, send SMS and export or overwrite the configuration via the clone API. Exploitation requires network reachability of the device.

Affected

• pppscn SmsForwarder, versions 0 through 3.5.0
• Default configuration is affected

Fixed in

Unknown. No official fixed version has been identified.

Workaround

• Turn off the remote-control/server feature in the app if your version allows it (setting name not verified)
• Block the app's HTTP port at the router and firewall and do not port-forward it
• Reach the device only over a VPN you control
• Disable intranet traversal (frp) unless required
• Remove the app from devices where remote control is not needed

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• No evidence of in-the-wild exploitation found
• No public proof-of-concept found
• VulDB rates the attack as easy and requiring no authentication

Our recommendation

• Identify all devices running SmsForwarder and check whether the remote-control server is enabled and reachable from untrusted networks
• Remove or isolate affected installations now, especially phones used for SMS-based 2FA
• Block the app's port at the firewall and disable port forwarding
• If exposure is suspected, assume SMS and contact data were read; rotate passwords and tokens tied to SMS 2FA and review forwarding targets
• Re-check the upstream project for a fixed release before reinstalling

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-110618 VulnCheck advisory www.vulncheck.com
• SmsForwarder GitHub repository github.com
• AppMessageConverter.kt at v3.5.0 github.com
• HttpServerUtils.kt at v3.5.0 github.com
• Write-up on hackmd hackmd.io
• SmsForwarder releases github.com
• VulDB entry 420018 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:12.