SmsForwarder through version 3.5.0 contains a missing authentication flaw in its AndServer HTTP server. The flaw allows an unauthenticated attacker to call default‑enabled remote‑control API endpoints that can read SMS messages, call logs, and contacts, send SMS, and export or overwrite the device’s configuration. The data disclosed and the control granted can lead to privacy violations and a potential vector for further attacks.

The vulnerability affects the SmsForwarder product from pppscn, specifically all releases up to and including 3.5.0. Users of earlier versions are also potentially exposed if they have not applied any later patches.

The CVSS score of 8.6 reflects substantial impact with a likely remote network attack vector. The EPSS score is below 1%, and the vulnerability is not listed in CISA’s KEV catalog, so the current exploitation likelihood is low, but the lack of authentication makes exploitation straightforward for network attackers who can reach the device’s HTTP server.