CVE-2017-2735 - TIT-AL00 smartphones with software versions earlier before TIT-AL00C583B214 have a exposed system in

CVE-2017-2735

Summary

TIT-AL00 smartphones with software versions earlier before TIT-AL00C583B214 have a exposed system interface vulnerability. The software provides a system interface for interaction with external applications, but calling the interface is not properly restricted. An attacker could trick the user into installing a malicious application to call the interface and modify the system properties.

References

Vulnerable Configurations

cpe:2.3:o:huawei:y6_pro_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:huawei:y6_pro_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:huawei:y6_pro_firmware:9.1.0.248\(c636e5r3p1\):*:*:*:*:*:*:*
cpe:2.3:o:huawei:y6_pro_firmware:9.1.0.248\(c636e5r3p1\):*:*:*:*:*:*:*
cpe:2.3:h:huawei:y6_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:y6_pro:-:*:*:*:*:*:*:*

CVSS

Base:	5.8 (as of 11-12-2017 - 17:37)
Impact:
Exploitability:

CWE

CWE-749

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:P

refmap via4

bid	97224
confirm	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170329-01-smartphone-en

Last major update

11-12-2017 - 17:37

Published

22-11-2017 - 19:29

Last modified

11-12-2017 - 17:37