PT-2018-6422 · Huawei · Huawei Smartphone

Publicado 2018-02-15 · Atualizado 2019-10-03 · CVE-2017-17161

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Huawei smart phones versions earlier than Duke-L09C10B186 Huawei smart phones versions earlier than Duke-L09C432B187 Huawei smart phones versions earlier than Duke-L09C636B186

Description: The issue is related to an authentication bypass in the 'Find Phone' function due to improper authentication realization. This allows an attacker to bypass the 'Find Phone' function, enabling normal use of the phone.

Recommendations: For versions earlier than Duke-L09C10B186, update to Duke-L09C10B186 or later to resolve the issue. For versions earlier than Duke-L09C432B187, update to Duke-L09C432B187 or later to resolve the issue. For versions earlier than Duke-L09C636B186, update to Duke-L09C636B186 or later to resolve the issue. As a temporary workaround, consider disabling the 'Find Phone' function until a patch is available.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-17161

Produtos afetados

Huawei Smartphone

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-17161 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-17161 · Nota de Segurança
• http://huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171213-01-smartphone-en · Aviso do Fabricante