Medium severity · published Apr 11, 2018
CVE-2018-7930
The Near Field Communication (NFC) module in Mate 9 Huawei mobile phones with the versions before MHA-L29B 8.0.0.366(C567) has an information leak vulnerability due to…
5.7
CVSS
0.4%
EPSS
No
On KEV
Description
The Near Field Communication (NFC) module in Mate 9 Huawei mobile phones with the versions before MHA-L29B 8.0.0.366(C567) has an information leak vulnerability due to insufficient validation on data transfer requests. When an affected mobile phone sends files to an attacker's mobile phone using the NFC function, the attacker can obtain arbitrary files from the mobile phone, causing information leaks.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M9
Mate 9 Firmware · Huawei
before mha-l29b_8.0.0.366\(c567\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7930
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7930
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180411-01-smartphone-en
More from Mate 9 Firmware
8.8
CVE-2017-15311
The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120(SP2C00), before…
7.8
CVE-2017-15316
The GPU driver of Mate 9 Huawei smart phones with software before MHA-AL00B 8.0.0.334(C00) and Mate 9 Pro Huawei smart phones with software before LON-AL00B 8.0.0.334(C00) has a…
7.8
CVE-2017-8142
The Trusted Execution Environment (TEE) module driver of Mate 9 and Mate 9 Pro smart phones with software versions earlier than MHA-AL00BC00B221 and versions earlier than…
7.8
CVE-2017-2716
The camerafs driver in Mate 9 Versions earlier than MHA-AL00BC00B173 has buffer overflow vulnerability
7.1
CVE-2017-2707
Mate 9 smartphones with software MHA-AL00AC00B125 have a privilege escalation vulnerability in Push module