Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2018-7939

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
12/09/2018
Last modified:
03/10/2019

Description

Huawei smart phones G9 Lite, Honor 5A, Honor 6X, Honor 8 with the versions before VNS-L53C605B120CUSTC605D103, the versions before CAM-L03C605B143CUSTC605D008, the versions before CAM-L21C10B145, the versions before CAM-L21C185B156, the versions before CAM-L21C223B133, the versions before CAM-L21C432B210, the versions before CAM-L21C464B170, the versions before CAM-L21C636B245, the versions before Berlin-L21C10B372, the versions before Berlin-L21C185B363, the versions before Berlin-L21C464B137, the versions before Berlin-L23C605B161, the versions before FRD-L09C10B387, the versions before FRD-L09C185B387, the versions before FRD-L09C432B398, the versions before FRD-L09C636B387, the versions before FRD-L19C10B387, the versions before FRD-L19C432B399, the versions before FRD-L19C636B387 have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can disable the boot wizard by enable the talkback function. As a result, the FRP function is bypassed.

Impact

Vector 3.x
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 4.60 MEDIUM
Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): High
Availability (A): None

Base Score 3.x
4.60
Severity 3.x
MEDIUM
Vector 2.0
AV:L/AC:L/Au:N/C:N/I:C/A:N CVSS v2.0 Severity and Metrics:

Base Score: 4.90 MEDIUM
Vector: AV:L/AC:L/Au:N/C:N/I:C/A:N

Attack Vector (AV): Local
Attack Complexity (AC): Low
Authentication (Au): None
Confidentiality (C): None
Integrity (I): Complete
Availability (A): None

Base Score 2.0
4.90
Severity 2.0
MEDIUM

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:huawei:g9_lite_firmware:*:*:*:*:*:*:*:* vns-l53c605b120custc605d103 (excluding)
cpe:2.3:h:huawei:g9_lite:-:*:*:*:*:*:*:*
cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* cam-l03c605b143custc605d008 (excluding)
cpe:2.3:h:huawei:honor_5a:-:*:*:*:*:*:*:*
cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* cam-l21c10b145 (excluding)
cpe:2.3:h:huawei:honor_5a:-:*:*:*:*:*:*:*
cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* cam-l21c185b156 (excluding)
cpe:2.3:h:huawei:honor_5a:-:*:*:*:*:*:*:*
cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* cam-l21c223b133 (excluding)
cpe:2.3:h:huawei:honor_5a:-:*:*:*:*:*:*:*
cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* cam-l21c432b210 (excluding)
cpe:2.3:h:huawei:honor_5a:-:*:*:*:*:*:*:*
cpe:2.3:o:huawei:honor_5a:*:*:*:*:*:*:*:* cam-l21c464b170 (excluding)
cpe:2.3:h:huawei:honor_5a:-:*:*:*:*:*:*:*
cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* cam-l21c636b245 (excluding)

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools