1030 matches found
Security Advisory - FRP Bypass Vulnerability on Some Huawei Smartphones
There is a Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the FRP function, an attacker can delete the activation lock after a series of operation, As a result, the FRP function is bypassed and the attacker gains...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an information leak vulnerability due to the lack of input validation. An attacker tricks the user who has root privilege to install an application on the smart phone, and the application can read some process information, which may cause sensitive information leak...
Security Advisory - Double Free Vulnerability on Bastet Module of Some Huawei Smartphones
There is a double free vulnerability on Bastet module of some Huawei smartphones. An attacker tricks the user into installing a malicious application, which frees on the same memory address twice. Successful exploit could result in malicious code execution. Vulnerability ID: HWPSIRT-2018-12500 Th...
Security Advisory - Out-of-bounds Read Vulnerability in Some Huawei Smartphones
Some Huawei smartphones have an out-of-bounds read vulnerability. An attacker with a high permission runs some specific commands on the smartphone. Due to insufficient input verification, successful exploit may cause out-of-bounds read of the memory and the system abnormal. Vulnerability ID:...
Security Advisory - Information Leakage Vulnerability on Some Smartphones
There is an information leak vulnerability in some Huawei phones. When a local attacker use the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations. Vulnerability ID: HWPSIRT-2019-01101 This vulnerability has bee...
Security Advisory - Authorization Bypass Vulnerability on Some Huawei Smartphone
Some Huawei smart phones have an authorization bypass vulnerability. Due to improper authorization implementation logic, attackers can bypass certain authorization scopes of smart phones by performing specific operations. This vulnerability can be exploited to perform operations beyond the scope ...
Security Advisory - Double Free Vulnerability on Smartphones
There is a double free vulnerability on certain driver of smartphones. An attacker tricks the user into installing a malicious application, which makes multiple processes to operate the same resource at the same time. Successful exploit could cause a denial of service condition. Vulnerability ID:...
Security Advisory - Memory Double Free Vulnerability in Image Processing Module of Some Huawei Smart Phones
The image processing module of some Huawei smart phones has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which could trigger double free and cause a system crash. Vulnerability ID: HWPSIRT-2018-110...
Security Advisory - FragmentSmack Vulnerability in Linux Kernel
There is a DoS vulnerability in the Linux Kernel versions 3.9+ known as a FragmentSmack attack. Remote attackers could send fragmented IPv4 or IPv6 packets to the affected device to trigger time and calculation reassembly algorithms that could consume excessive CPU resources, resulting in a DoS...
Security Advisory - Race Condition Vulnerability on Several Smartphones
There is a race condition vulnerability on certain driver of smartphone. An attacker tricks the user into installing a malicious application, which make multiple processes to operate the same variate at the same time. Successful exploit could cause execution of malicious code. Vulnerability ID:...
Security Advisory - Two Vulnerabilities in Huawei PCManager Product
There is a privilege escalation vulnerability in Huawei PCManager product. Successful exploitation may cause the attacker to obtain a higher privilege. Vulnerability ID: HWPSIRT-2018-11141 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2019-5241. There is ...
Security Advisory - Use After Free Vulnerability on Several Smartphones
There is a use after free vulnerability on certain driver component in smartphone. An attacker tricks the user into installing a malicious application, which make the software to reference memory after it has been freed. Successful exploit could cause a denial of service condition. Vulnerability...
Security Advisory - Cache Timing Vulnerability in OpenSSL RSA Key Generation
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack CVE-2018-0737. An attacker could exploit this vulnerability to recover the private key. Vulnerability ID: HWPSIRT-2018-06015 Huawei has released software updates to fix this vulnerabilit...
Security Advisory - Information Leakage in Huawei VIP App Web Service
Huawei VIP App is mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability that attackers can conduct bruteforce to the VIP App Web Services to get user information leakage. Vulnerability ID: HWPSIRT-2018-11111 This vulnerability has been assign...
Security Advisory - Out-of-bounds Write Vulnerability on Several Smartphones
There is an out-of-bounds write vulnerability on several smartphones. The software does not handle the response message properly when the user doing certain inquiry operation, an attacker could send crafted message to the device, successful exploit could cause a denial of service condition...
Security Advisory - Information Leak Vulnerability in Some Huawei Smartphones
There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and trick a user into inputting some sensitive information. Due to improper design, successful exploit may cause some information leak. Vulnerability ID:...
Security Advisory - Smart SMS Verification Code Vulnerability in Some Huawei Smart Phones
There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App and register. Due to incorrect processing of the smart SMS verification code, successful exploitation can cause sensitive information leak...
Security Advisory - Two Vulnerabilities in Huawei eSpace Product
There is a short key vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept and decrypt the call information when the user enables SRTP to make a call. Successful exploitation may cause sensitive information leak. Vulnerability I...
Security Advisory - Anonymous TLS Cipher Suite Supported Vulnerability in Huawei eSpace Product
There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication, which may be exploite...
Security Advisory - FRP Bypass Vulnerability on Several Smartphones
There is a Factory Reset Protection FRP bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to another smartphone and then perform a series of specific operations. Successful exploit could all...
Security Advisory - Information Leakage Vulnerability on Several Huawei Products
There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection for specific services, a remote, unauthorized attacker can exploit this vulnerability to connect to specific services to obtain additional information. Successful exploitation of...
Security Advisory - Lock-screen Bypass Vulnerability in Huawei Smartphones
There is a lock-screen bypass vulnerability in radio module of some Huawei smartphones. An unauthenticated attacker could start third-part input method APP through certain operations to bypass lock-screen by exploit this vulnerability. Vulnerability ID: HWPSIRT-2018-04055 This vulnerability has...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the vulnerability can be used to replace the start-up program so that the attacker can obtain the information in the smartphone and achieve the purpose of controlling the...
Security Advisory - SegmentSmack Vulnerability in Linux Kernel
There is a DoS vulnerability in the Linux Kernel versions 4.9+ known as a SegmentSmack attack. Remote attackers may send TCP packets to Linux kernel to make it calls the very expensive functions tcpcollapseofoqueue and tcppruneofoqueue of the affected device which can lead to a denial of service...
Security Advisory - Improper Authorization Vulnerability in Huawei Watches
There is an improper authorization vulnerability in some Huawei watches. Due to improper permission configuration for specific operations, an attacker who obtained the Huawei ID bound to the watch can bypass permission verification to perform specific operations and modify some data on the watch...
Security Advisory - SegmentSmack Vulnerability in Linux Kernel
There is a DoS vulnerability in the Linux Kernel versions 4.9+ known as a SegmentSmack attack. Remote attackers may send TCP packets to Linux kernel to make it calls the very expensive functions tcpcollapseofoqueue and tcppruneofoqueue of the affected device which can lead to a denial of service...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
Some Huawei phones have an information leak vulnerability. Due to improper permission settings for specific commands, attackers who can connect to a mobile phone via the USB interface may exploit this vulnerability to obtain specific device information of the mobile phone. Vulnerability ID:...
Security Advisory - Improper Authentication Vulnerability on Smartphones
There is an improper authentication vulnerability on smartphones. App Lock is a function to prevent unauthorized use of apps on smartphones, an attacker could directly change the lock password after a series of operations. Successful exploit could allow the attacker to use the application which i...
Security Advisory - FRP Bypass Vulnerability in MyCloud APP of Huawei Smart Phones
There is a security vulnerability which could lead to Factory Reset Protection FRP bypass in the MyCloud APP installed on some Huawei smart phones. When re-configuring the mobile phone using the FRP function, an attacker can replace the old account with a new one through special steps by exploit...
Security Advisory - Sensitive Information Leak Vulnerability in Some Huawei Products
There is a sensitive information leak vulnerability in some Huawei products. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the input, successful exploitation can cause sensitive information leak. Vulnerability ID...
Security Advisory - Lock-screen Bypass Vulnerability in Huawei Mate RS Smartphones
There is a lock-screen bypass vulnerability in Huawei Mate RS smartphones. An attacker could unlock and use the phone through certain operations. Vulnerability ID: HWPSIRT-2018-06108 This vulnerability has been assigned a CVE ID: CVE-2018-7929. Huawei has released software updates to fix this...
Security Advisory - FRP Bypass Vulnerability on Smartphones
There is a Factory Reset Protection FRP bypass vulnerability on some Huawei smartphones. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to the computer and then perform some specific operations. Successful exploit could allow the...
Security Advisory - Two Insufficient Input Validation Vulnerabilities in Huawei Smart Phones
Some Huawei phones have two insufficient input validation vulnerabilities due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify different specific data to exploit these two vulnerabilities. Successful exploi...
Security Advisory - DoS Vulnerability in Some Huawei Smart Phones
There is a denial of service DoS vulnerability in some Huawei smart phones. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the parameter, successful exploitation can cause the smartphone black screen until...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can disable the boot wizard by enable the talkback function. As a result, the FRP function is bypassed...
Security Advisory - FRP Bypass Vulnerability on Huawei Smart Phones
There is a FRP bypass vulnerability on Huawei smart phones. During the mobile phone reseting process, an attacker could bypass "Find My Phone" protect after a series of voice and keyboard operations. Successful exploit could allow an attacker to bypass FRP. Vulnerability ID: HWPSIRT-2018-06018 Th...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some hardware serial number, which may cause sensitive information leak...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can connect the phone with PC and send special instructions to install third party desktop and disable...
Security Advisory - Plug-in Signature Bypass Vulnerability in Some Huawei Products
There is a plug-in signature bypass vulnerability in some Huawei products due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into installing it. Successful exploit could allow the attacker to obtain the root...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can login the configuration flow by Gaode Map and can perform some operations to update the Google...
Security Advisory - CPU Side Channel Vulnerability "L1TF"
Intel and security researchers publicly disclosed three new cpu side-channel vulnerabilities CVE-2018-3615, CVE-2018-3620 and CVE-2018-3646. Successful exploit of these vulnerabilities could allow a local attacker to read the memory of other processes in specific situations. These vulnerabilities...
Security Advisory - Multiple Vulnerabilities in IPsec IKE of Huawei Firewall Products
There is a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbacher RSA padding oracle. Cause a Bleichenbacher oracle attack. Successful exploit this vulnerability c...
Security Advisory - Buffer Overflow Vulnerability on Several Products
There is a buffer overflow vulnerability on madapt driver of several products. The driver does not sufficiently validate the input, an attacker could trick the user to install a malicious application which would send crafted parameters to the driver. Successful exploit could cause a denial of...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Mobile Phones
There is an authentication bypass vulnerability in some Huawei mobile phones. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause som...
Security Advisory - Use After Free Vulnerability on Smartphone
There is a use after free vulnerability on mediaserver component in smartphone. An attacker tricks the user install a malicious application, which make the software to reference memory after it has been freed. Successful exploit could cause execution of arbitrary code. Vulnerability ID:...
Security Advisory - DoS Vulnerability in Some Huawei Smart Phones
Some Huawei mobile phone versions have a denial of service DoS vulnerability because they do not adapt to specific screen gestures. An attacker may trick users into installing a malicious app. As a result, apps running on the frontend crash after the users make specific screen gestures...
Security Advisory - Information Leakage Vulnerability on Huawei Smart Phone
There is an information leakage vulnerability. Because an interface does not verify authorization correctly, attackers can exploit an application with the authorization of phone state to obtain user location additionally. Vulnerability ID: HWPSIRT-2018-03117 This vulnerability has been assigned a...
Security Advisory - Memory Leak Vulnerability on Several Products
There is a memory leak vulnerability on several products. The software does not release allocated memory properly when processing Protal questionnaire. A remote attacker could send a lot questionnaires to the device, successful exploit could cause the device to reboot since running out of memory...
Security Advisory - Weak Algorithm Vulnerability in Some Huawei Products
There is a weak algorithm vulnerability in some Huawei products. To exploit the vulnerability, a remote, unauthenticated attacker has to capture TLS traffic between clients and the affected products. The attacker may launch the Bleichenbacher attack on RSA key exchange to decrypt the session key...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in the Common Open Policy Service Protocol COPS module of some Huawei products. An unauthenticated, remote attacker has to control the peer device and send specially crafted message to the affected products. Due to insufficient input validation, successful...