PT-2018-6422 · Huawei · Huawei Smartphone

Published 2018-02-15 · Updated 2019-10-03 · CVE-2017-17161

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Huawei smart phones versions earlier than Duke-L09C10B186 Huawei smart phones versions earlier than Duke-L09C432B187 Huawei smart phones versions earlier than Duke-L09C636B186

Description: The issue is related to an authentication bypass in the 'Find Phone' function due to improper authentication realization. This allows an attacker to bypass the 'Find Phone' function, enabling normal use of the phone.

Recommendations: For versions earlier than Duke-L09C10B186, update to Duke-L09C10B186 or later to resolve the issue. For versions earlier than Duke-L09C432B187, update to Duke-L09C432B187 or later to resolve the issue. For versions earlier than Duke-L09C636B186, update to Duke-L09C636B186 or later to resolve the issue. As a temporary workaround, consider disabling the 'Find Phone' function until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-17161

Affected Products

Huawei Smartphone

References · 3

• https://osv.dev/vulnerability/CVE-2017-17161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17161 · Security Note
• http://huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171213-01-smartphone-en · Vendor Advisory