PT-2018-6463 · Huawei · Huawei Mate 9 Pro

Published 2018-03-09 · Updated 2019-10-03 · CVE-2017-17279

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Huawei Mate 9 Pro smart phones with software versions prior to LON-AL00B 8.0.0.343(C00)

Description: The soundtrigger module has an authentication bypass issue due to improper design. An attacker can trick a user into installing a malicious application, which can exploit this issue to bypass authentication. Once exploited, the attacker can control the phone to send short messages and make calls within audio range to the phone.

Recommendations: For versions prior to LON-AL00B 8.0.0.343(C00), update to version LON-AL00B 8.0.0.343(C00) or later to resolve the issue. As a temporary workaround, consider restricting the installation of applications from untrusted sources to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2017-17279

Affected Products

Huawei Mate 9 Pro

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-17279 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17279 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20180307-01-smartphone-en · Vendor Advisory
• http://securityfocus.com/bid/103360 · Note