Security Advisory - Brute-force attack of Users' Safe Password in the Files APP in Huawei Mobile Phones

The Files APP in some Huawei mobile phones has a brute-force password cracking vulnerability due to the improper design of the Safe key database. An unauthorized attacker could access sensitive database information and may crack users’ Safe passwords, leading to information leak. (Vulnerability ID: HWPSIRT-2017-03146)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-2715.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170425-01-files-en