MajorCritical vulnerability

CVE-2026-110618 (CVSS 8.6)

NVD · officialPublished Oct 14, 2026Risk 37/100

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.

Technical details

CVSS

8.6

AV:AdjacentAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source