Low severity · published Mar 9, 2018
CVE-2017-17149
Huawei HiWallet App with the versions before 8.0.4 has an arbitrary lock pattern change vulnerability
3.9
CVSS
0.2%
EPSS
No
On KEV
Description
Huawei HiWallet App with the versions before 8.0.4 has an arbitrary lock pattern change vulnerability. It needs to verify the user's Huawei ID during lock pattern change. An attacker with root privilege who gets a user's smart phone may bypass Huawei ID verification by special operation. Successful exploit of this vulnerability can allow an attacker to change the lock pattern of HiWallet.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HI
Hiwallet · Huawei
before 8.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17149
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17149
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-hiwallet-en
More from Hiwallet
7.5
CVE-2017-2704
Smarthome 1.0.2.364 and earlier versions,HiAPP 7.3.0.303 and earlier versions,HwParentControl 2.0.0 and earlier versions,HwParentControlParent 5.1.0.12 and earlier…
5.3
CVE-2017-8177
Huawei APP HiWallet earlier than 5.0.3.100 versions do not support signature verification for APK file