exploitDog

CVE-2017-2705

Опубликовано: 22 нояб. 2017

Источник: nvd

CVSS3: 2.4

CVSS2: 2.1

EPSS Низкий

Описание

Huawei P9 smartphones with software versions earlier before EVA-AL10C00B365, versions earlier before EVA-AL00C00B365, versions earlier before EVA-CL00C92B365, versions earlier before EVA-DL00C17B365, versions earlier before EVA-TL00C01B365 have a phone activation bypass vulnerability. Successful exploit could allow an unauthenticated attacker to bypass phone activation to settings page of the phone.

Ссылки

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170118-02-smartphone-en
Issue Tracking
Vendor Advisory
http://www.securityfocus.com/bid/95661
Third Party Advisory
VDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170118-02-smartphone-en
Issue Tracking
Vendor Advisory
http://www.securityfocus.com/bid/95661
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:huawei:p9_firmware:*:*:*:*:*:*:*:*

Версия до eva-al00c00b365 (исключая)

cpe:2.3:h:huawei:p9:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:huawei:p9_firmware:*:*:*:*:*:*:*:*

Версия до eva-al10c00b365 (исключая)

cpe:2.3:h:huawei:p9:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:huawei:p9_firmware:*:*:*:*:*:*:*:*

Версия до eva-cl00c92b365 (исключая)

cpe:2.3:h:huawei:p9:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:huawei:p9_firmware:*:*:*:*:*:*:*:*

Версия до eva-dl00c17b365 (исключая)

cpe:2.3:h:huawei:p9:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:huawei:p9_firmware:*:*:*:*:*:*:*:*

Версия до eva-tl00c01b365 (исключая)

cpe:2.3:h:huawei:p9:-:*:*:*:*:*:*:*

EPSS

Процентиль: 14%

0.00047

Низкий

2.4 Low

CVSS3

2.1 Low

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-3mfm-97cm-96cr

CVSS3: 2.4

github

больше 3 лет назад

Huawei P9 smartphones with software versions earlier before EVA-AL10C00B365, versions earlier before EVA-AL00C00B365, versions earlier before EVA-CL00C92B365, versions earlier before EVA-DL00C17B365, versions earlier before EVA-TL00C01B365 have a phone activation bypass vulnerability. Successful exploit could allow an unauthenticated attacker to bypass phone activation to settings page of the phone.

EPSS

Процентиль: 14%

0.00047

Низкий

2.4 Low

CVSS3

2.1 Low

CVSS2

Дефекты

NVD-CWE-noinfo