PT-2017-18169 · Huawei · Eva-L09

Publicado 2017-11-22 · Atualizado 2019-10-03 · CVE-2017-8161

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions EVA-L09 smartphones with software Earlier than EVA-L09C25B150CUSTC25D003 versions EVA-L09 smartphones with software Earlier than EVA-L09C440B140 versions EVA-L09 smartphones with software Earlier than EVA-L09C464B361 versions EVA-L09 smartphones with software Earlier than EVA-L09C675B320CUSTC675D004 versions

Description The issue allows an attacker to bypass the Factory Reset Protection (FRP) when re-configuring the mobile phone. By utilizing the FRP function, an attacker can login to Swype and perform operations to update the Google account, effectively bypassing the FRP function.

Recommendations For EVA-L09 smartphones with software Earlier than EVA-L09C25B150CUSTC25D003 versions, update to EVA-L09C25B150CUSTC25D003 or later. For EVA-L09 smartphones with software Earlier than EVA-L09C440B140 versions, update to EVA-L09C440B140 or later. For EVA-L09 smartphones with software Earlier than EVA-L09C464B361 versions, update to EVA-L09C464B361 or later. For EVA-L09 smartphones with software Earlier than EVA-L09C675B320CUSTC675D004 versions, update to EVA-L09C675B320CUSTC675D004 or later.

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

CVE-2017-8161

Produtos afetados

Eva-L09

Referências · 3

• http://huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171013-01-frpbypass-en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8161 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8161 · Aviso do Fabricante