Medium severity · published May 24, 2018
CVE-2017-17158
Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before…
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prague-TL00AC01B223 have an information exposure vulnerability. When the user's smart phone connects to the malicious device for charging, an unauthenticated attacker may activate some specific function by sending some specially crafted messages. Due to insufficient input validation of the messages, successful exploit may cause information exposure.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Berlin-L21HN; Prague-AL00A; Prague-AL00B; Prague-AL00C; Prague-L31; Prague-TL00A; Prague-TL10A · Huawei Technologies Co., Ltd.
The versions before Berlin-L21HNC185B381; The versions before Prague-AL00AC00B223; The versions before Prague-AL00BC00B223; The versions before Prague-AL00CC00B223; The versions before Prague-L31C432B208; The versions before Prague-TL00AC01B223 · source: vendor
BF
Berlin-l21hn Firmware · Huawei
before l21hnc185b381 · source: NVD
PF
Prague-al00a Firmware · Huawei
before al00ac00b223 · source: NVD
PF
Prague-al00b Firmware · Huawei
before al00bc00b223 · source: NVD
PF
Prague-al00c Firmware · Huawei
before al00cc00b223 · source: NVD
PF
Prague-l31 Firmware · Huawei
before l31c432b208 · source: NVD
PF
Prague-tl00a Firmware · Huawei
before tl00ac01b223 · source: NVD
PF
Prague-tl10a Firmware · Huawei
before tl00ac01b223 · source: NVD
Affected product
BP
Berlin-L21HN; Prague-AL00A; Prague-AL00B; Prague-AL00C; Prague-L31; Prague-TL00A; Prague-TL10A
Huawei Technologies Co., Ltd.
