# CVE-2016-10138: BLU and Adups privilege escalation in FOTA sysoper app

Source: https://junglewise.ai/threats/cve-2016-10138-blu-and-adups-privilege-escalation-in-fota-sysoper-app  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-13. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-10138 · Severity: high · CVSS 7.8 · Published 2017-01-13

A pre-installed system application on certain BLU mobile devices contains a security flaw that allows other apps or network attackers to take control of the phone. This software, which cannot be disabled by the user, can be exploited to record the screen, take photos, install unauthorized apps, or factory reset the device. This puts personal data, privacy, and device availability at significant risk.

Technologies: [Adups Fota](https://junglewise.ai/threats/technologies/adups-fota). Vendors: [Adups](https://junglewise.ai/threats/vendors/adups).

## Quick answers

**Is CVE-2016-10138 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10138 being exploited in the wild.

**How severe is CVE-2016-10138?** High severity, with a CVSS score of 7.8, published 13 January 2017.

**Which products and versions are affected?** BLU Advance 5.0; BLU R1 HD; Shanghai Adups Technology FOTA sysoper.

**Is there a fix for CVE-2016-10138?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-10138 attacked?** It is attacked with local access or over the network, in an operating system.

**Am I affected by CVE-2016-10138?** Check whether you run Adups Fota or Shanghai Adups Technology FOTA sysoper. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The com.adups.fota.sysoper application is installed as a system app with the 'android.uid.system' shared user ID, granting it high privileges. It exposes a broadcast receiver, 'WriteCommandReceiver', which is exported and accessible to any local application, allowing them to send intents that execute commands as the system user. Additionally, the 'TaskService' component fetches commands over unencrypted HTTP from a remote server, making the device vulnerable to Man-in-the-Middle (MITM) attacks where a network attacker can inject and execute arbitrary system-level commands. Exploitation can lead to screen recording, unauthorized app installation, and full device resets.

## Affected products

- BLU Advance 5.0
- BLU R1 HD
- Shanghai Adups Technology FOTA sysoper

## Timeline

- 2016-11-16: disclosed: Media coverage of Adups software security issues
- 2017-01-13: advisory: NVD publication date

## References

- [http://www.securityfocus.com/bid/96853](http://www.securityfocus.com/bid/96853)
- [https://www.kryptowire.com/adups_security_analysis.html](https://www.kryptowire.com/adups_security_analysis.html)
- [https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html](https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html)

## Related threats

- [BLU R1 HD Privilege Escalation and Data Exfiltration in Adups FOTA](https://junglewise.ai/threats/cve-2016-10139-blu-r1-hd-privilege-escalation-and-data-exfiltration-in-adups)
- [BLU R1 HD privilege escalation in Adups FOTA InfoProvider](https://junglewise.ai/threats/cve-2016-10137-blu-r1-hd-privilege-escalation-in-adups-fota-infoprovider)
- [BLU R1 HD privilege escalation in Adups FOTA software](https://junglewise.ai/threats/cve-2016-10136-blu-r1-hd-privilege-escalation-in-adups-fota-software)