Medium severity · published Nov 22, 2017
CVE-2017-8202
The CameraISP driver of some Huawei smart phones with software of versions earlier than Prague-AL00AC00B205,versions earlier than Prague-AL00BC00B205,versions earlier than…
5.5
CVSS
0.7%
EPSS
No
On KEV
Description
The CameraISP driver of some Huawei smart phones with software of versions earlier than Prague-AL00AC00B205,versions earlier than Prague-AL00BC00B205,versions earlier than Prague-AL00CC00B205,versions earlier than Prague-TL00AC01B205,versions earlier than Prague-TL10AC01B205 has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP, the APP can send a specific parameter to the CameraISP driver of the smart phone, causing system reboot.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Prague-AL00A,Prague-AL00B,Prague-AL00C,Prague-TL00A,Prague-TL10A · Huawei Technologies Co., Ltd.
Versions earlier than Prague-AL00AC00B205,Versions earlier than Prague-AL00BC00B205,Versions earlier than Prague-AL00CC00B205,Versions earlier than Prague-TL00AC01B205,Versions earlier than Prague-TL10AC01B205 · source: vendor
PF
Prague-al00a Firmware · Huawei
before prague-al00ac00b205 · source: NVD
PF
Prague-al00b Firmware · Huawei
before prague-al00bc00b205 · source: NVD
PF
Prague-al00c Firmware · Huawei
before prague-al00cc00b205 · source: NVD
PF
Prague-tl00a Firmware · Huawei
before prague-tl00ac01b205 · source: NVD
PF
Prague-tl10a Firmware · Huawei
before prague-tl10ac01b205 · source: NVD
Affected product
PR
Prague-AL00A,Prague-AL00B,Prague-AL00C,Prague-TL00A,Prague-TL10A
Huawei Technologies Co., Ltd.