Auth bypass in Huawei Berlin-L21
CVE-2017-2721
Some Huawei smart phones with software Berlin-L21C10B130,Berlin-L21C185B133,Berlin-L21HNC10B131,Berlin-L21HNC185B140,Berlin-L21HNC432B151,Berlin-L22C636B160,Berlin-L22HNC636B130,Berlin-L22HNC675B150CUSTC675D001,Berlin-L23C605B131,Berlin-L24HNC567B110,FRD-L02C432B120,FRD-L02C635B130,FRD-L02C675B170CUSTC675D001,FRD-L04C567B162,FRD-L04C605B131,FRD-L09C10B130,FRD-L09C185B130,FRD-L09C432B131,FRD-L09C636B130,FRD-L14C567B162,FRD-L19C10B130,FRD-L19C432B131,FRD-L19C636B130 have a factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by Swype Keyboard and can perform some operations to update the Google account. As a result, the FRP function is bypassed.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.002 (8.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 8.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Huawei Berlin-L21
- Huawei Berlin-L21 Firmware — versions berlin-l21c10b130, berlin-l21c185b133
- Huawei Berlin-L21hn
- Huawei Berlin-L21hn Firmware — versions berlin-l21hnc10b131, berlin-l21hnc185b140, berlin-l21hnc432b151
- Huawei Berlin-L22
- Huawei Berlin-L22 Firmware — versions berlin-l22c636b160
- Huawei Berlin-L22hn
- Huawei Berlin-L22hn Firmware — versions berlin-l22hnc636b130, berlin-l22hnc675b150custc675d001
- Huawei Berlin-L23
- Huawei Berlin-L23 Firmware — versions berlin-l23c605b131
Weakness classification (CWE)
References
- www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-frpbypass-en (Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-2721?
- CVE-2017-2721 is a medium-severity vulnerability in Huawei Berlin-L21, classified under Improper Authentication. CVSS score: 4.6/10. Published 2017-11-22.
- How severe is CVE-2017-2721?
- Medium severity. CVSS v3 base score is 4.6 out of 10.