Vulnerability Details : CVE-2017-17149
Huawei HiWallet App with the versions before 8.0.4 has an arbitrary lock pattern change vulnerability. It needs to verify the user's Huawei ID during lock pattern change. An attacker with root privilege who gets a user's smart phone may bypass Huawei ID verification by special operation. Successful exploit of this vulnerability can allow an attacker to change the lock pattern of HiWallet.
Products affected by CVE-2017-17149
- cpe:2.3:a:huawei:hiwallet:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-17149
0.03%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 4 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-17149
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:P/A:N |
3.9
|
2.9
|
NIST | |
|
3.9
|
LOW | CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
0.3
|
3.6
|
NIST |
References for CVE-2017-17149
-
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-hiwallet-en
Security Advisory - Arbitrary Lock Pattern Change Vulnerability in Huawei HiWallet APPVendor Advisory
Jump to