PT-2018-18319 · Huawei · Bla-Al00B+4

François Poucheret + 1 · Published 2018-11-13 · Updated 2018-12-12 · CVE-2018-7910

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Huawei smartphones ALP-AL00B version 8.0.0.118D(C00) Huawei smartphones ALP-TL00B version 8.0.0.118D(C01) Huawei smartphones BLA-AL00B version 8.0.0.118D(C00) Huawei smartphones BLA-L09C versions 8.0.0.127(C432) through 8.0.0.137(C432) Huawei smartphones BLA-L29C versions 8.0.0.129(C432) through 8.0.0.137(C432)

Description: The issue allows an attacker to bypass authentication on the affected devices. If an attacker gains physical access to the smartphone, they can exploit this to replace the start-up program, potentially allowing them to access information on the device and control it.

Recommendations: For ALP-AL00B version 8.0.0.118D(C00), update to a newer version that addresses the authentication bypass issue. For ALP-TL00B version 8.0.0.118D(C01), update to a newer version that addresses the authentication bypass issue. For BLA-AL00B version 8.0.0.118D(C00), update to a newer version that addresses the authentication bypass issue. For BLA-L09C versions 8.0.0.127(C432) through 8.0.0.137(C432), update to a newer version that addresses the authentication bypass issue. For BLA-L29C versions 8.0.0.129(C432) through 8.0.0.137(C432), update to a newer version that addresses the authentication bypass issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-7910

Affected Products

Alp-Al00B

Alp-Tl00B

Bla-Al00B

Bla-L09C

Bla-L29C

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7910 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20181101-01-bypass-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7910 · Vendor Advisory