Medium severity · published Feb 15, 2018
CVE-2017-15351
The 'Find Phone' function in Huawei Honor V9 play smart phones with versions earlier than Jimmy-AL00AC00B135 has an authentication bypass vulnerability
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
The 'Find Phone' function in Huawei Honor V9 play smart phones with versions earlier than Jimmy-AL00AC00B135 has an authentication bypass vulnerability. Due to improper authentication realization in the 'Find Phone' function. An attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HV
Honor V9 Play Firmware · Huawei
jimmy-al00ac00b135 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15351
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15351
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171122-01-smartphone-en
More from Honor V9 Play Firmware
9.8
CVE-2017-14491
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response
4.6
CVE-2017-17145
Huawei Honor V9 Play smart phones with the versions before Jimmy-AL00AC00B135 have an authentication bypass vulnerability due to the improper design of a component