What is CVE-2017-17161?

CVE-2017-17161 is a medium-severity vulnerability in Huawei Duke-L09, classified under Improper Authentication. CVSS score: 6.8/10. Published 2018-02-15.

How severe is CVE-2017-17161?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Auth bypass in Huawei Duke-L09

CVE-2017-17161

The 'Find Phone' function in some Huawei smart phones with software earlier than Duke-L09C10B186 versions, earlier than Duke-L09C432B187 versions, earlier than Duke-L09C636B186 versions has an authentication bypass vulnerability. Due to improper authentication realization in the 'Find Phone' function. An attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally.

Vulnerability class: Broken Authentication

EPSS: 0.003 (25.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Huawei Duke-l09
Huawei Duke-l09_firmware
Huawei Technologies Co., Ltd. Duke-l09 — versions Earlier than Duke-L09C10B186 versions, Earlier than Duke-L09C432B187 versions, Earlier than Duke-L09C636B186 versions

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@huawei.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2017-17161?: CVE-2017-17161 is a medium-severity vulnerability in Huawei Duke-L09, classified under Improper Authentication. CVSS score: 6.8/10. Published 2018-02-15.
How severe is CVE-2017-17161?: Medium severity. CVSS v3 base score is 6.8 out of 10.