Huawei TechnologiesHUAWEI-SA-20181121-01-PHONESecurity Advisory - Information Leak Vulnerability in Some Huawei Smartphones
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS
Percentile
29.0%
There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and trick a user into inputting some sensitive information. Due to improper design, successful exploit may cause some information leak. (Vulnerability ID: HWPSIRT-2018-09002)
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2018-7946.
Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181121-01-phone-en
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| huawei | alp-al00b_firmware | * | cpe:2.3:o:huawei:alp-al00b_firmware:*:*:*:*:*:*:*:* |
| huawei | alp-l09_firmware | * | cpe:2.3:o:huawei:alp-l09_firmware:*:*:*:*:*:*:*:* |
| huawei | alp-l29_firmware | * | cpe:2.3:o:huawei:alp-l29_firmware:*:*:*:*:*:*:*:* |
| huawei | anne-al00_firmware | * | cpe:2.3:o:huawei:anne-al00_firmware:*:*:*:*:*:*:*:* |
| huawei | jenny-al10b_firmware | * | cpe:2.3:o:huawei:jenny-al10b_firmware:*:*:*:*:*:*:*:* |
| huawei | sydneym-l03_firmware | * | cpe:2.3:o:huawei:sydneym-l03_firmware:*:*:*:*:*:*:*:* |
| huawei | atomu-l41_firmware | * | cpe:2.3:o:huawei:atomu-l41_firmware:*:*:*:*:*:*:*:* |
| huawei | lyo-l21_firmware | * | cpe:2.3:o:huawei:lyo-l21_firmware:*:*:*:*:*:*:*:* |
| huawei | florida-l23_firmware | * | cpe:2.3:o:huawei:florida-l23_firmware:*:*:*:*:*:*:*:* |
| huawei | cornell-l29a_firmware | * | cpe:2.3:o:huawei:cornell-l29a_firmware:*:*:*:*:*:*:*:* |
Related
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS
Percentile
29.0%