Huawei TechnologiesHUAWEI-SA-20161207-01-SMARTPHONESecurity Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N
4.6 Medium
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
23.2%
There is Factory Reset Protection (FRP) bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can enter some functional modules without authorization and perform operations to update the Google account. As a result, the FRP function is bypassed. (Vulnerability ID: HWPSIRT-2016-09010)
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2016-8776.
Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161207-01-smartphone-en
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| p9 | eq | EVA-AL10C00 | |
| p9 | eq | EVA-CL10C00 | |
| p9 | eq | EVA-DL10C00 | |
| p9 | eq | EVA-TL10C00 | |
| p9 lite | eq | VNS-L21C185 |
Related
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N
4.6 Medium
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
23.2%