Lucene search

HuaweiCVE-2017-2728

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-2728

2017-11-2219:29:01

huawei

web.nvd.nist.gov

huawei

mobile phone

bluetooth

unlock

bypassing

vulnerability

smart unlock

nvd

cve-2017-2728

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.4

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

27.1%

JSON

Some Huawei mobile phones Honor 6X Berlin-L22C636B150 and earlier versions have a Bluetooth unlock bypassing vulnerability. If a user has enabled the smart unlock function, an attacker can impersonate the user’s Bluetooth device to unlock the user’s mobile phone screen.uawei mobile phones have a Bluetooth unlock bypassing vulnerability due to the lack of validation on Bluetooth devices. If a user has enabled the smart unlock function, an attacker can impersonate the user’s Bluetooth device to unlock the user’s mobile phone screen.

Affected configurations

Nvd

Node

huaweihonor_6x_firmwareRange≤berlin-l22c636b150

AND

huaweihonor_6xMatch-

VendorProductVersionCPE
huaweihonor_6x_firmware*cpe:2.3:o:huawei:honor_6x_firmware:*:*:*:*:*:*:*:*
huaweihonor_6x-cpe:2.3:h:huawei:honor_6x:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	honor_6x_firmware	*	cpe:2.3:o:huawei:honor_6x_firmware::::::::
huawei	honor_6x	-	cpe:2.3:h:huawei:honor_6x:-:::::::*

CNA Affected

[
  {
    "product": "Honor 6X",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Berlin-L22C636B150 and earlier versions"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170323-01-smartphone-en

www.securityfocus.com/bid/97042

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.4

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

27.1%

JSON

Related for CVE-2017-2728