Executive brief
DesktopSMS Lite is an Android application that allows users to send and receive SMS messages from a desktop. The vulnerability permits any installed app with only basic internet permission to forge pairing approval with DesktopSMS Lite's local service, allowing the attacker to send SMS and read all stored SMS conversations without ever requesting SMS permissions. This could enable credential theft via SMS-based two-factor codes, unauthorized message sending, and privacy violation through message interception.
Technical details
DesktopSMS Lite runs an unauthenticated local service on 127.0.0.1:8000 that accepts pairing requests without validating the requestor's identity. An attacker app with only INTERNET permission can forge a COM_PAIR_REQUEST_RESULT result=true message with an attacker-controlled DeviceGuid to bypass the pairing authorization check. Once accepted, the forged identity gains access to privileged commands (sendsms.dsms.cmd.icl, search-conversations-request.dsms.cmd.icl) that execute SMS operations using DesktopSMS Lite's SMS permissions, even though the attacking app holds no SEND_SMS or READ_SMS permissions.
Affected products
- MrPear DesktopSMS Lite 1.11.0
Timeline
- 2026-09-21: disclosed