All vulnerabilities
CVE-2026-110618

SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API

pppscn SmsForwarder
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published14 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.

Text from CVE List

Affected versions 1

  • SmsForwarderaffected: all versions through 3.5.0CVE List

References 5