Vulnerability in Huawei Alp-Al00b
CVE-2018-7911
Some Huawei smart phones ALP-AL00B 8.0.0.106(C00), 8.0.0.113(SP2C00), 8.0.0.113(SP3C00), 8.0.0.113(SP7C00), 8.0.0.118(C00), 8.0.0.120(SP2C00), 8.0.0.125(SP1C00), 8.0.0.125(SP3C00), 8.0.0.126(SP2C00), 8.0.0.126(SP5C00), 8.0.0.127(SP1C00), 8.0.0.128(SP2C00), ALP-AL00B-RSC 1.0.0.2, BLA-TL00B 8.0.0.113(SP7C01), 8.0.0.118(C01), 8.0.0.120(SP2C01), 8.0.0.125(SP1C01), 8.0.0.125(SP2C01), 8.0.0.125(SP3C01), 8.0.0.126(SP2C01), 8.0.0.126(SP5C01), 8.0.0.127(SP1C01), 8.0.0.128(SP2C01), 8.0.0.129(SP2C01), Charlotte-AL00A 8.1.0.105(SP7C00), 8.1.0.106(SP3C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP3C00), 8.1.0.108(SP6C00), 8.1.0.109(SP2C00), Emily-AL00A 8.1.0.105(SP6C00), 8.1.0.106(SP2C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP2C00), 8.1.0.108(SP6C00), 8.1.0.109(SP5C00) have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by Gaode Map and can perform some operations to update the Google account. As a result, the FRP function is bypassed.
EPSS: 0.002 (14.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Huawei Alp-al00b
- Huawei Alp-al00b_firmware — versions 8.0.0.120(sp2c00), 8.0.0.128(sp2c00), 8.0.0.106(c00)
- Huawei Alp-al00b-rsc
- Huawei Alp-al00b-rsc_firmware — versions 1.0.0.2
- Huawei Bla-tl00b
- Huawei Bla-tl00b_firmware — versions 8.0.0.128(sp2c01), 8.0.0.125(sp1c01), 8.0.0.126\(sp2c01\)
- Huawei Charlotte-al00a
- Huawei Charlotte-al00a_firmware — versions 8.1.0.107(sp5c00), 8.1.0.108(sp6c00), 8.1.0.107\(sp7c00\)
- Huawei Emily-al00a
- Huawei Emily-al00a_firmware — versions 8.1.0.107(sp5c00), 8.1.0.108(sp6c00), 8.1.0.107\(sp7c00\)
References
- psirt@huawei.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-7911?
- CVE-2018-7911 is a medium-severity vulnerability in Huawei Alp-Al00b. CVSS score: 4.6/10. Published 2018-10-23.
- How severe is CVE-2018-7911?
- Medium severity. CVSS v3 base score is 4.6 out of 10.