CVE-2024-1608 is a critical (CVSS 9.1) loose permission check in the OPPO Usercenter Credit SDK that could lead to escalation of privilege and a leak of application internal information without user interaction. The record names no versions, so check OPPO's security notice and update affected apps.
What's affected
The record names the OPPO Usercenter Credit software development kit and gives no version range and no fixed version. Its only reference is an OPPO security center notice. The page I fetched rendered only the site shell, so I could not read the notice text.
Because this is an SDK, the exposure comes through apps that embed it. Check OPPO's notice for which SDK builds and which apps or system components are affected, and whether the fix arrives through a system update or an app update.
How to check if you're exposed
There is no single command. For app developers who embed the SDK, search your build files for the SDK's package name:
grep -rni "usercenter" build.gradle app/build.gradle
For device owners, check system update settings and the app store for pending updates, then compare with OPPO's notice. Fleet managers can use mobile device management inventory to list OPPO devices and OS builds.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Read the OPPO security notice and note the affected SDK versions.
- If you ship an app with the SDK, update it to a fixed build and release a new app version.
- Install pending system and app updates on OPPO devices.
- Review what app permissions and exported components your own apps expose.
- Use your dependency inventory to find any other apps embedding the SDK.
Why it matters
The record classes this as CWE-280, improper handling of insufficient permissions or privileges. A component granted access after a check that was too loose, so other apps on the device could ask for information they should not see.
Attacks on mobile components of this kind need an app on the same device rather than network access, but the record's scoring treats the impact as high and the need for user action as none. Without the vendor text, the best advice is to follow the vendor update path. The record's KEV flag is false.
Quick check
Is a fixed version named?
Not in the record. Check OPPO's security notice.
Does it need user interaction?
The record says the leak can happen without user interaction.
Sources
Last reviewed: 19 October 2026.
