Medium severity · published Nov 22, 2017
CVE-2017-8152
Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have a Factory Reset Protection (FRP) bypass security vulnerability due to the improper design
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have a Factory Reset Protection (FRP) bypass security vulnerability due to the improper design. An attacker can access factory reset page without authorization by only dial with special code. The attacker can exploit this vulnerability to restore the phone to factory settings.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H5
Honor 5S · Huawei Technologies Co., Ltd.
The versions before TAG-TL00C01B173 · source: vendor
H5
Honor 5s Firmware · Huawei
before tag-tl00c01b173 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8152
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8152
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170901-02-smartphone-en
More from Honor 5S
6.8
CVE-2017-8151
Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have an authentication bypass vulnerability due to the improper design of some components