Lucene search

[email protected]CVE-2018-7939

HistorySep 12, 2018 - 3:29 p.m.

CVE-2018-7939

2018-09-1215:29:01

[email protected]

web.nvd.nist.gov

huawei

smartphones

g9 lite

honor 5a

honor 6x

honor 8

security

vulnerability

frp bypass

cve-2018-7939

nvd

4.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:C/A:N

4.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.2%

JSON

Huawei smart phones G9 Lite, Honor 5A, Honor 6X, Honor 8 with the versions before VNS-L53C605B120CUSTC605D103, the versions before CAM-L03C605B143CUSTC605D008, the versions before CAM-L21C10B145, the versions before CAM-L21C185B156, the versions before CAM-L21C223B133, the versions before CAM-L21C432B210, the versions before CAM-L21C464B170, the versions before CAM-L21C636B245, the versions before Berlin-L21C10B372, the versions before Berlin-L21C185B363, the versions before Berlin-L21C464B137, the versions before Berlin-L23C605B161, the versions before FRD-L09C10B387, the versions before FRD-L09C185B387, the versions before FRD-L09C432B398, the versions before FRD-L09C636B387, the versions before FRD-L19C10B387, the versions before FRD-L19C432B399, the versions before FRD-L19C636B387 have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can disable the boot wizard by enable the talkback function. As a result, the FRP function is bypassed.

Affected configurations

NVD

Node

huaweig9_lite_firmwareRange<vns-l53c605b120custc605d103

AND

huaweig9_liteMatch-

Node

huaweihonor_5a_firmwareRange<cam-l03c605b143custc605d008

AND

huaweihonor_5aMatch-

Node

huaweihonor_5a_firmwareRange<cam-l21c10b145

AND

huaweihonor_5aMatch-

Node

huaweihonor_5a_firmwareRange<cam-l21c185b156

AND

huaweihonor_5aMatch-

Node

huaweihonor_5a_firmwareRange<cam-l21c223b133

AND

huaweihonor_5aMatch-

Node

huaweihonor_5a_firmwareRange<cam-l21c432b210

AND

huaweihonor_5aMatch-

Node

huaweihonor_5aRange<cam-l21c464b170

AND

huaweihonor_5aMatch-

Node

huaweihonor_5a_firmwareRange<cam-l21c636b245

AND

huaweihonor_5aMatch-

Node

huaweihonor_6x_firmwareRange<berlin-l21c10b372

AND

huaweihonor_6xMatch-

Node

huaweihonor_6x_firmwareRange<berlin-l21c185b363

AND

huaweihonor_6xMatch-

Node

huaweihonor_6x_firmwareRange<berlin-l21c464b137

AND

huaweihonor_6xMatch-

Node

huaweihonor_6x_firmwareRange<berlin-l23c605b161

AND

huaweihonor_6xMatch-

Node

huaweihonor_8_firmwareRange<frd-l09c10b387

AND

huaweihonor_8Match-

Node

huaweihonor_8_firmwareRange<frd-l09c185b387

AND

huaweihonor_8Match-

Node

huaweihonor_8_firmwareRange<frd-l09c432b398

AND

huaweihonor_8Match-

Node

huaweihonor_8_firmwareRange<frd-l09c636b387

AND

huaweihonor_8Match-

Node

huaweihonor_8_firmwareRange<frd-l19c10b387

AND

huaweihonor_8Match-

Node

huaweihonor_8_firmwareRange<frd-l19c432b399

AND

huaweihonor_8Match-

Node

huaweihonor_8_firmwareRange<frd-l19c636b387

AND

huaweihonor_8Match-

CPENameOperatorVersion
huawei:g9_lite_firmwarehuawei g9 lite firmwareltvns-l53c605b120custc605d103

CPE	Name	Operator	Version
huawei:g9_lite_firmware	huawei g9 lite firmware	lt	vns-l53c605b120custc605d103

CNA Affected

[
  {
    "product": "G9 Lite, Honor 5A, Honor 6X, Honor 8",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "The versions before VNS-L53C605B120CUSTC605D103, The versions before CAM-L03C605B143CUSTC605D008, The versions before CAM-L21C10B145, The versions before CAM-L21C185B156, The versions before CAM-L21C223B133, The versions before CAM-L21C432B210, The versions before CAM-L21C464B170, The versions before CAM-L21C636B245, The versions before Berlin-L21C10B372, The versions before Berlin-L21C185B363, The versions before Berlin-L21C464B137, The versions before Berlin-L23C605B161, The versions before FRD-L09C10B387, The versions before FRD-L09C185B387, The versions before FRD-L09C432B398, The versions before FRD-L09C636B387, The versions before FRD-L19C10B387, The versions before FRD-L19C432B399, The versions before FRD-L19C636B387,"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20180905-01-frpbypass-en

4.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:C/A:N

4.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.2%

JSON

Related for CVE-2018-7939

prion1 huawei1 cvelist1 nvd1