PT-2017-18169 · Huawei · Eva-L09

Published 2017-11-22 · Updated 2019-10-03 · CVE-2017-8161

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions EVA-L09 smartphones with software Earlier than EVA-L09C25B150CUSTC25D003 versions EVA-L09 smartphones with software Earlier than EVA-L09C440B140 versions EVA-L09 smartphones with software Earlier than EVA-L09C464B361 versions EVA-L09 smartphones with software Earlier than EVA-L09C675B320CUSTC675D004 versions

Description The issue allows an attacker to bypass the Factory Reset Protection (FRP) when re-configuring the mobile phone. By utilizing the FRP function, an attacker can login to Swype and perform operations to update the Google account, effectively bypassing the FRP function.

Recommendations For EVA-L09 smartphones with software Earlier than EVA-L09C25B150CUSTC25D003 versions, update to EVA-L09C25B150CUSTC25D003 or later. For EVA-L09 smartphones with software Earlier than EVA-L09C440B140 versions, update to EVA-L09C440B140 or later. For EVA-L09 smartphones with software Earlier than EVA-L09C464B361 versions, update to EVA-L09C464B361 or later. For EVA-L09 smartphones with software Earlier than EVA-L09C675B320CUSTC675D004 versions, update to EVA-L09C675B320CUSTC675D004 or later.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2017-8161

Affected Products

Eva-L09

References · 3

• http://huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171013-01-frpbypass-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8161 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8161 · Vendor Advisory