CVE-2018-7910 : Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BL

Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128(C432), 8.0.0.137(C432), BLA-L29C 8.0.0.129(C432), 8.0.0.137(C432) have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the vulnerability can be used to replace the start-up program so that the attacker can obtain the information in the smartphone and achieve the purpose of controlling the smartphone.

Published 2018-11-13 19:29:00

Updated 2018-12-12 20:39:49

Source Huawei Technologies

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2018-7910

Huawei » Alp-al00b Firmware » Version: 8.0.0.1.18d(c00)
cpe:2.3:o:huawei:alp-al00b_firmware:8.0.0.1.18d\(c00\):*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Alp-al00b » Version: N/A
Huawei » Alp-tl00b Firmware » Version: 8.0.0.1.18d(c01)
cpe:2.3:o:huawei:alp-tl00b_firmware:8.0.0.1.18d\(c01\):*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Alp-tl00b » Version: N/A
Huawei » Bla-al00b Firmware » Version: 8.0.0.1.18d(c00)
cpe:2.3:o:huawei:bla-al00b_firmware:8.0.0.1.18d\(c00\):*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Bla-al00b » Version: N/A
Huawei » Bla-l09c Firmware » Version: 8.0.0.128(c432)
cpe:2.3:o:huawei:bla-l09c_firmware:8.0.0.128\(c432\):*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Bla-l09c » Version: N/A
Huawei » Bla-l09c Firmware » Version: 8.0.0.137(c432)
cpe:2.3:o:huawei:bla-l09c_firmware:8.0.0.137\(c432\):*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Bla-l09c » Version: N/A
Huawei » Bla-l09c Firmware » Version: 8.0.0.127(c432)
cpe:2.3:o:huawei:bla-l09c_firmware:8.0.0.127\(c432\):*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Bla-l09c » Version: N/A
Huawei » Bla-l29c Firmware » Version: 8.0.0.137(c432)
cpe:2.3:o:huawei:bla-l29c_firmware:8.0.0.137\(c432\):*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Bla-l29c » Version: N/A
Huawei » Bla-l29c Firmware » Version: 8.0.0.127(c432)
cpe:2.3:o:huawei:bla-l29c_firmware:8.0.0.127\(c432\):*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Bla-l29c » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-7910

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 28 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-7910

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.8	MEDIUM	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	0.9	5.9	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-7910

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-7910

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181101-01-bypass-en

Security Advisory - Authentication Bypass Vulnerability in Some Huawei Smart Phones
Vendor Advisory

Jump to

Vulnerability Details : CVE-2018-7910

Products affected by CVE-2018-7910

Exploit prediction scoring system (EPSS) score for CVE-2018-7910

CVSS scores for CVE-2018-7910

CWE ids for CVE-2018-7910

References for CVE-2018-7910