VulnerabilityModified

CVE-2017-17159

Some Huawei smart phones with software of NXT-AL10C00B386, NXT-CL00C92B386, NXT-DL00C17B386, NXT-TL00C01B386SP01, NTS-AL00C00B535 have a DoS vulnerability due to insufficient input validation.

MEDIUM 6.5EPSS 0.37%

Does this matter?

Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.

Description

Some Huawei smart phones with software of NXT-AL10C00B386, NXT-CL00C92B386, NXT-DL00C17B386, NXT-TL00C01B386SP01, NTS-AL00C00B535 have a DoS vulnerability due to insufficient input validation. An unauthenticated attacker could send malformed System Information(SI) messages to the smart phone within radio range by special wireless device. Successful exploit could make the smart phone restart.

CVSS 3.0: 6.5 MEDIUMCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.37% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: huawei/mt8-emui4.1 firmware · huawei/nts-al00 firmware
Source: psirt@huawei.com

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-02-smartphone-enVendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-02-smartphone-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.