VulnerabilityModified

CVE-2018-7947

Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability.

LOW 3.9EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause some malicious applications to be installed in the mobile phones.

CVSS 3.0: 3.9 LOWCVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-287
Affected: huawei/emily-al00a firmware
Source: psirt@huawei.com

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180720-01-mobile-enVendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180720-01-mobile-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.