PT-2017-15495 · Huawei · Nice

Published 2017-11-22 · Updated 2019-10-03 · CVE-2017-2708

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Nice smartphones versions prior to Nice-AL00C00B0135

Description The issue concerns an authentication bypass in the 'Find Phone' function. This allows an unauthenticated attacker to potentially wipe and factory reset the phone by following specific steps, due to the lack of proper authentication in the 'Find Phone' function. As a result, an attacker could exploit this to bypass the intended security measures of the 'Find Phone' function, enabling them to use the phone normally without authorization.

Recommendations For versions prior to Nice-AL00C00B0135, as a temporary workaround, consider disabling the 'Find Phone' function until a patch is available. Restrict access to the 'Find Phone' feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2017-2708

Affected Products

Nice

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-2708 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2708 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20170125-01-smartphone-en · Vendor Advisory
• http://securityfocus.com/bid/95911 · Note