Medium severity · published Feb 15, 2018
CVE-2017-17161
The 'Find Phone' function in some Huawei smart phones with software earlier than Duke-L09C10B186 versions, earlier than Duke-L09C432B187 versions, earlier than Duke-L09C636B186…
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
The 'Find Phone' function in some Huawei smart phones with software earlier than Duke-L09C10B186 versions, earlier than Duke-L09C432B187 versions, earlier than Duke-L09C636B186 versions has an authentication bypass vulnerability. Due to improper authentication realization in the 'Find Phone' function. An attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Duke-l09 Firmware · Huawei
before duke-l09c10b186; before duke-l09c432b187; before duke-l09c636b186 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17161
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171213-01-smartphone-en
More from Duke-l09 Firmware
5.5
CVE-2020-9239
Huawei smartphones BLA-A09 versions 8.0.0.123(C212),versions earlier than 8.0.0.123(C567),versions earlier than 8.0.0.123(C797);BLA-TL00B versions earlier than…