« Volver al listado

CVE-2017-8175

Estado: ModificadaMedia (5.5)—

The Bastet of some Huawei mobile phones with software earlier than Vicky-AL00AC00B167 versions, earlier than Victoria-AL00AC00B167 versions, earlier than Warsaw-AL00C00B191 versions has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The APP can modify specific parameter to cause system reboot.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Huawei — Vicky-al00aHuawei — Victoria-al00aHuawei — Warsaw-al00

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8175",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.1,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@huawei.com",
      "affectedData": [
        {
          "vendor": "Huawei Technologies Co., Ltd.",
          "product": "Vicky-AL00A,Victoria-AL00A,Warsaw-AL00",
          "versions": [
            {
              "status": "affected",
              "version": "Earlier than Vicky-AL00AC00B167 versions,Earlier than Victoria-AL00AC00B167 versions,Earlier than Warsaw-AL00C00B191 versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-11-22T19:29:04.163",
  "references": [
    {
      "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170802-02-smartphone-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170802-02-smartphone-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Bastet of some Huawei mobile phones with software earlier than Vicky-AL00AC00B167 versions, earlier than Victoria-AL00AC00B167 versions, earlier than Warsaw-AL00C00B191 versions has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The APP can modify specific parameter to cause system reboot."
    },
    {
      "lang": "es",
      "value": "El controlador Bastet de algunos smartphones Huawei con software anterior a las versiones Vicky-AL00AC00B167, Victoria-AL00AC00B167 y Warsaw-AL00C00B191 tiene una vulnerabilidad de validación insuficiente de valores de entrada debido a la falta de validación de parámetros. Un atacante podría engañar a un usuario para que instale una app maliciosa. La app puede modificar un parámetro específico para hacer que el sistema se reinicie."
    }
  ],
  "lastModified": "2026-06-17T01:25:55.027",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:huawei:vicky-al00a:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45D4D70E-9172-4F75-ACF7-C956481473B7",
              "versionEndExcluding": "vicky-al00ac00b167"
            },
            {
              "criteria": "cpe:2.3:a:huawei:victoria-al00a:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B948367-9009-439D-846D-6F6BBDB57D21",
              "versionEndExcluding": "victoria-al00ac00b167"
            },
            {
              "criteria": "cpe:2.3:a:huawei:warsaw-al00:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C09AC24-0D9F-41BE-A527-99A1D06C651B",
              "versionEndExcluding": "warsaw-al00c00b191"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@huawei.com"
}