Lucene search

HuaweiCVE-2017-8210

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-8210

2017-11-2219:29:05

CWE-119

huawei

web.nvd.nist.gov

cve-2017-8210

driver vulnerability

honor 5c

honor 6x

huawei smartphones

buffer overflow

nvd

security issue

android system vulnerability

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

46.1%

JSON

The driver of honor 5C,honor 6x Huawei smart phones with software of versions earlier than NEM-AL10C00B356, versions earlier than Berlin-L21HNC432B360 have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege of the Android system, the APP can send a specific parameter to the driver of the smart phone, causing a system reboot or arbitrary code execution.

Affected configurations

Nvd

Node

huaweihonor_5c_firmwareRange<nem-al10c00b356

AND

huaweihonor_5cMatch-

Node

huaweihonor_6x_firmwareRange<berlin-l21hnc432b360

AND

huaweihonor_6xMatch-

VendorProductVersionCPE
huaweihonor_5c_firmware*cpe:2.3:o:huawei:honor_5c_firmware:*:*:*:*:*:*:*:*
huaweihonor_5c-cpe:2.3:h:huawei:honor_5c:-:*:*:*:*:*:*:*
huaweihonor_6x_firmware*cpe:2.3:o:huawei:honor_6x_firmware:*:*:*:*:*:*:*:*
huaweihonor_6x-cpe:2.3:h:huawei:honor_6x:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	honor_5c_firmware	*	cpe:2.3:o:huawei:honor_5c_firmware::::::::
huawei	honor_5c	-	cpe:2.3:h:huawei:honor_5c:-:::::::*
huawei	honor_6x_firmware	*	cpe:2.3:o:huawei:honor_6x_firmware::::::::
huawei	honor_6x	-	cpe:2.3:h:huawei:honor_6x:-:::::::*

CNA Affected

[
  {
    "product": "honor 5C,honor 6x",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Versions earlier than NEM-AL10C00B356,Versions earlier than Berlin-L21HNC432B360"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20170801-01-smartphone-en

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

46.1%

JSON

Related for CVE-2017-8210