Lucene search

[email protected]CVE-2018-7907

HistorySep 26, 2018 - 1:29 p.m.

CVE-2018-7907

2018-09-2613:29:00

CWE-200

[email protected]

web.nvd.nist.gov

huawei

products

vulnerability

sensitive information leak

nvd

cve-2018-7907

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.1%

JSON

Some Huawei products Agassi-L09 AGS-L09C100B257CUSTC100D001, AGS-L09C170B253CUSTC170D001, AGS-L09C199B251CUSTC199D001, AGS-L09C229B003CUSTC229D001, Agassi-W09 AGS-W09C100B257CUSTC100D001, AGS-W09C128B252CUSTC128D001, AGS-W09C170B252CUSTC170D001, AGS-W09C229B251CUSTC229D001, AGS-W09C331B003CUSTC331D001, AGS-W09C794B001CUSTC794D001, Baggio2-U01A BG2-U01C100B160CUSTC100D001, BG2-U01C170B160CUSTC170D001, BG2-U01C199B162CUSTC199D001, BG2-U01C209B160CUSTC209D001, BG2-U01C333B160CUSTC333D001, Bond-AL00C Bond-AL00CC00B201, Bond-AL10B Bond-AL10BC00B201, Bond-TL10B Bond-TL10BC01B201, Bond-TL10C Bond-TL10CC01B131, Haydn-L1JB HDN-L1JC137B068, Kobe-L09A KOB-L09C100B252CUSTC100D001, KOB-L09C209B002CUSTC209D001, KOB-L09C362B001CUSTC362D001, Kobe-L09AHN KOB-L09C233B226, Kobe-W09C KOB-W09C128B251CUSTC128D001, LelandP-L22C 8.0.0.101(C675CUSTC675D2), LelandP-L22D 8.0.0.101(C675CUSTC675D2), Rhone-AL00 Rhone-AL00C00B186, Selina-L02 Selina-L02C432B153, Stanford-L09S Stanford-L09SC432B183, Toronto-AL00 Toronto-AL00C00B223, Toronto-AL00A Toronto-AL00AC00B223, Toronto-TL10 Toronto-TL10C01B223 have a sensitive information leak vulnerability. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the input, successful exploitation can cause sensitive information leak.

Affected configurations

NVD

Node

huaweiagassi-l09_firmwareMatchags-l09c100b257custc100d001

huaweiagassi-l09_firmwareMatchags-l09c170b253custc170d001

huaweiagassi-l09_firmwareMatchags-l09c199b251custc199d001

huaweiagassi-l09_firmwareMatchags-l09c229b003custc229d001

AND

huaweiagassi-l09Match-

Node

huaweiagassi-w09_firmwareMatchags-w09c100b257custc100d001

huaweiagassi-w09_firmwareMatchags-w09c128b252custc128d001

huaweiagassi-w09_firmwareMatchags-w09c170b252custc170d001

huaweiagassi-w09_firmwareMatchags-w09c229b251custc229d001

huaweiagassi-w09_firmwareMatchags-w09c331b003custc331d001

huaweiagassi-w09_firmwareMatchags-w09c794b001custc794d001

AND

huaweiagassi-w09Match-

Node

huaweibaggio2-u01a_firmwareMatchbg2-u01c100b160custc100d001

huaweibaggio2-u01a_firmwareMatchbg2-u01c170b160custc170d001

huaweibaggio2-u01a_firmwareMatchbg2-u01c199b162custc199d001

huaweibaggio2-u01a_firmwareMatchbg2-u01c209b160custc209d001

huaweibaggio2-u01a_firmwareMatchbg2-u01c333b160custc333d001

AND

huaweibaggio2-u01aMatch-

Node

huaweibond-al00c_firmwareMatchbond-al00cc00b201

AND

huaweibond-al00cMatch-

Node

huaweibond-al10b_firmwareMatchbond-al10bc00b201

AND

huaweibond-al10bMatch-

Node

huaweibond-tl10b_firmwareMatchbond-tl10bc01b201

AND

huaweibond-tl10bMatch-

Node

huaweibond-tl10c_firmwareMatchbond-tl10cc01b131

AND

huaweibond-tl10cMatch-

Node

huaweihaydn-l1jb_firmwareMatchhdn-l1jc137b068

AND

huaweihaydn-l1jbMatch-

Node

huaweikobe-l09a_firmwareMatchkob-l09c100b252custc100d001

huaweikobe-l09a_firmwareMatchkob-l09c209b002custc209d001

huaweikobe-l09a_firmwareMatchkob-l09c362b001custc362d001

AND

huaweikobe-l09aMatch-

Node

huaweikobe-l09ahn_firmwareMatchkob-l09c233b226

AND

huaweikobe-l09ahnMatch-

Node

huaweikobe-w09c_firmwareMatchkob-w09c128b251custc128d001

AND

huaweikobe-w09cMatch-

Node

huaweilelandp-l22c_firmwareMatch8.0.0.101_c675custc675d2

AND

huaweilelandp-l22cMatch-

Node

huaweilelandp-l22d_firmwareMatch8.0.0.101_c675custc675d2

AND

huaweilelandp-l22dMatch-

Node

huaweirhone-al00_firmwareMatchrhone-al00c00b186

AND

huaweirhone-al00Match-

Node

huaweiselina-l02_firmwareMatchselina-l02c432b153

AND

huaweiselina-l02Match-

Node

huaweistanford-l09s_firmwareMatchstanford-l09sc432b183

AND

huaweistanford-l09sMatch-

Node

huaweitoronto-al00_firmwareMatchtoronto-al00c00b223

AND

huaweitoronto-al00Match-

Node

huaweitoronto-al00a_firmwareMatchtoronto-al00ac00b223

AND

huaweitoronto-al00aMatch-

Node

huaweitoronto-tl10_firmwareMatchtoronto-tl10c01b223

AND

huaweitoronto-tl10Match-

CPENameOperatorVersion
huawei:agassi-l09_firmwarehuawei agassi-l09 firmwareeqags-l09c100b257custc100d001
huawei:agassi-l09_firmwarehuawei agassi-l09 firmwareeqags-l09c170b253custc170d001
huawei:agassi-l09_firmwarehuawei agassi-l09 firmwareeqags-l09c199b251custc199d001
huawei:agassi-l09_firmwarehuawei agassi-l09 firmwareeqags-l09c229b003custc229d001

CPE	Name	Operator	Version
huawei:agassi-l09_firmware	huawei agassi-l09 firmware	eq	ags-l09c100b257custc100d001
huawei:agassi-l09_firmware	huawei agassi-l09 firmware	eq	ags-l09c170b253custc170d001
huawei:agassi-l09_firmware	huawei agassi-l09 firmware	eq	ags-l09c199b251custc199d001
huawei:agassi-l09_firmware	huawei agassi-l09 firmware	eq	ags-l09c229b003custc229d001

CNA Affected

[
  {
    "product": "Agassi-L09,Agassi-W09,Baggio2-U01A,Bond-AL00C,Bond-AL10B,Bond-TL10B,Bond-TL10C,Haydn-L1JB,Kobe-L09A,Kobe-L09AHN,Kobe-W09C,LelandP-L22C,LelandP-L22D,Rhone-AL00,Selina-L02,Stanford-L09S,Toronto-AL00,Toronto-AL00A,Toronto-TL10",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Agassi-L09 AGS-L09C100B257CUSTC100D001, AGS-L09C170B253CUSTC170D001, AGS-L09C199B251CUSTC199D001, AGS-L09C229B003CUSTC229D001,Agassi-W09 AGS-W09C100B257CUSTC100D001, AGS-W09C128B252CUSTC128D001, AGS-W09C170B252CUSTC170D001, AGS-W09C229B251CUSTC229D001, AGS-W09C331B003CUSTC331D001, AGS-W09C794B001CUSTC794D001,Baggio2-U01A BG2-U01C100B160CUSTC100D001, BG2-U01C170B160CUSTC170D001, BG2-U01C199B162CUSTC199D001, BG2-U01C209B160CUSTC209D001, BG2-U01C333B160CUSTC333D001,Bond-AL00C Bond-AL00CC00B201,Bond-AL10B Bond-AL10BC00B201,Bond-TL10B Bond-TL10BC01B201,Bond-TL10C Bond-TL10CC01B131,Haydn-L1JB HDN-L1JC137B068,Kobe-L09A KOB-L09C100B252CUSTC100D001, KOB-L09C209B002CUSTC209D001, KOB-L09C362B001CUSTC362D001,Kobe-L09AHN KOB-L09C233B226,Kobe-W09C KOB-W09C128B251CUSTC128D001,LelandP-L22C 8.0.0.101(C675CUSTC675D2),LelandP-L22D 8.0.0.101(C675CUSTC675D2),Rhone-AL00 Rhone-AL00C00B186,Selina-L02 Selina-L02C432B153,Stanford-L09S Stanford-L09SC432B183,Toronto-AL00 Toronto-AL00C00B223,Toronto-AL00A Toronto-AL00AC00 ...[truncated*]"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20180919-02-smartphone-en

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.1%

JSON

Related for CVE-2018-7907

prion1 nvd1 huawei1 cvelist1