T-Mobile's vulnerability profile centers on a modest collection of consumer mobile devices and related firmware, including products such as the AC1900, REVVL Plus, and ZMax Pro lines that serve a broad user base. The vendor's disclosures reflect the complexity of embedded mobile platforms and their firmware update chains, which are characteristic of the telecommunications device landscape. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by T Mobile over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-9583HIGH common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the | Jan 8, 2015 | 10.0 | 86 | NO | YES |
CVE-2013-5948HIGH The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to exe | Apr 22, 2014 | 8.5 | 35 | NO | YES |
CVE-2018-14991CRITICAL The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/ur | Apr 25, 2019 | 9.8 | 29 | NO | NO |
CVE-2014-2718HIGH ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the inte | Nov 4, 2014 | 7.1 | 25 | NO | NO |
CVE-2007-1823HIGH T-Mobile voice mail systems allow remote attackers to retrieve or remove messages, or reconfigure mailboxes, by spoofing Calling Number Identification (CNID, aka Caller ID). | Apr 2, 2007 | 10.0 | 25 | NO | NO |
CVE-2018-15003HIGH The Coolpad Defiant (Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys) and the T-Mobile Revvl Plus (Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_ | Apr 25, 2019 | 7.5 | 24 | NO | NO |
CVE-2018-14990HIGH The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/ur | Apr 25, 2019 | 7.5 | 24 | NO | NO |
CVE-2013-1813HIGH util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impac | Nov 23, 2013 | 7.2 | 23 | NO | NO |
CVE-2011-2716MEDIUM The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_D | Jul 3, 2012 | 6.8 | 23 | NO | NO |
CVE-2012-2980HIGH The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile | Aug 21, 2012 | 7.1 | 22 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by T Mobile.
Media articles that mention a CVE ID that affects a product developed by T Mobile — matched by CVE ID, not by vendor name.