What is CVE-2018-7926?

CVE-2018-7926 is a medium-severity vulnerability in Huawei Watch 2, classified under Incorrect Authorization. CVSS score: 4.6/10. Published 2018-11-13.

How severe is CVE-2018-7926?

Medium severity. CVSS v3 base score is 4.6 out of 10.

Auth bypass in Huawei Watch 2

CVE-2018-7926

Huawei Watch 2 with versions and earlier than OWDD.180707.001.E1 have an improper authorization vulnerability. Due to improper permission configuration for specific operations, an attacker who obtained the Huawei ID bound to the watch can bypass permission verification to perform specific operations and modify some data on the watch.

Vulnerability class: Broken Access Control

EPSS: 0.002 (13.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Huawei Watch_2
Huawei Watch_2_firmware
Huawei Technologies Co., Ltd. Watch 2 — versions Versions and earlier than OWDD.180707.001.E1

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

psirt@huawei.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-7926?: CVE-2018-7926 is a medium-severity vulnerability in Huawei Watch 2, classified under Incorrect Authorization. CVSS score: 4.6/10. Published 2018-11-13.
How severe is CVE-2018-7926?: Medium severity. CVSS v3 base score is 4.6 out of 10.