Low severity · published Nov 22, 2017
CVE-2017-2694
The AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control over calling permissions, allowing any third party to call
3.3
CVSS
0.5%
EPSS
No
On KEV
Description
The AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control over calling permissions, allowing any third party to call. An attacker can construct a malicious application to call it. Consequently, alert music will be played suddenly, compromising user experience.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VM
Vmall · Huawei
before 1.5.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2694
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170125-01-vmall-en
Third Party Advisory
http://www.securityfocus.com/bid/95915
More from Vmall
7.1
CVE-2017-8153
Huawei VMall (for Android) with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design
3.1
CVE-2017-2739
The upgrade package of Huawei Vmall APP Earlier than HwVmall 1.5.3.0 versions is transferred through HTTP