PT-2017-15478 · Huawei · Huawei P9

Published 2017-11-22 · Updated 2019-10-03 · CVE-2017-2691

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Huawei P9 versions earlier than EVA-AL10C00B373 Huawei P9 versions earlier than EVA-CL00C92B373 Huawei P9 versions earlier than EVA-DL00C17B373 Huawei P9 versions earlier than EVA-TL00C01B373

Description The issue allows an unauthenticated attacker to bypass the lock screen. This can be achieved by forcing the phone into fastboot mode and deleting the user's password file during the reboot process, enabling the attacker to log in without the screen lock password after reboot.

Recommendations For versions earlier than EVA-AL10C00B373, update to EVA-AL10C00B373 or later. For versions earlier than EVA-CL00C92B373, update to EVA-CL00C92B373 or later. For versions earlier than EVA-DL00C17B373, update to EVA-DL00C17B373 or later. For versions earlier than EVA-TL00C01B373, update to EVA-TL00C01B373 or later.

Fix

Related Identifiers

CVE-2017-2691

Affected Products

Huawei P9

References · 4

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20170118-01-smartphone-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2691 · Security Note
• http://securityfocus.com/bid/95658 · Note