Medium severity · published May 10, 2018
CVE-2018-7940
Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.0.129(SP2C01) have an authentication bypass vulnerability
6.2
CVSS
0.3%
EPSS
No
On KEV
Description
Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.0.129(SP2C01) have an authentication bypass vulnerability. An attacker with high privilege obtains the smart phone and bypass the activation function by some specific operations.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M9
Mate 9 Firmware · Huawei
before 8.0.0.129\(sp2c00\) · source: NVD
M9
Mate 9 Pro Firmware · Huawei
before 8.0.0.129\(sp2c01\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7940
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7940
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180509-01-mobile-en
More from Mate 9 Firmware
8.8
CVE-2017-15311
The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120(SP2C00), before…
7.8
CVE-2017-15316
The GPU driver of Mate 9 Huawei smart phones with software before MHA-AL00B 8.0.0.334(C00) and Mate 9 Pro Huawei smart phones with software before LON-AL00B 8.0.0.334(C00) has a…
7.8
CVE-2017-8142
The Trusted Execution Environment (TEE) module driver of Mate 9 and Mate 9 Pro smart phones with software versions earlier than MHA-AL00BC00B221 and versions earlier than…
7.8
CVE-2017-2716
The camerafs driver in Mate 9 Versions earlier than MHA-AL00BC00B173 has buffer overflow vulnerability
7.1
CVE-2017-2707
Mate 9 smartphones with software MHA-AL00AC00B125 have a privilege escalation vulnerability in Push module