Medium severity · published Mar 9, 2018
CVE-2017-17326
Huawei Mate 9 Pro Smartphones with software of LON-AL00BC00B139D; LON-AL00BC00B229 have an activation lock bypass vulnerability
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
Huawei Mate 9 Pro Smartphones with software of LON-AL00BC00B139D; LON-AL00BC00B229 have an activation lock bypass vulnerability. The smartphone is supposed to be activated by the former account after reset if find my phone function is on. The software does not have a sufficient protection of activation lock. Successful exploit could allow an attacker to bypass the activation lock and activate the smartphone by a new account after a series of operation.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M9
Mate 9 Pro · Huawei Technologies Co., Ltd.
Mate 9 Pro LON-AL00BC00B139D; LON-AL00BC00B229 · source: vendor
M9
Mate 9 Pro Fimware · Huawei
lon-al00bc00b139d; lon-al00bc00b229 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17326
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171227-01-smartphone-en
More from Mate 9 Pro
8.8
CVE-2017-17225
The Near Field Communication (NFC) module in Huawei Mate 9 Pro mobile phones with the versions before LON-AL00B 8.0.0.340a(C00) has a buffer overflow vulnerability due to the lack…
8.8
CVE-2017-15311
The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120(SP2C00), before…
7.8
CVE-2017-17173
Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) has an arbitrary memory free…
7.8
CVE-2017-17320
Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability
7.8
CVE-2017-17324
Huawei Mate 9 Pro smartphones with software LON-AL00BC00B139D; LON-AL00BC00B229 have an integer overflow vulnerability