4.6

CVE-2017-17158

Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prague-TL00AC01B223 have an information exposure vulnerability. When the user's smart phone connects to the malicious device for charging, an unauthenticated attacker may activate some specific function by sending some specially crafted messages. Due to insufficient input validation of the messages, successful exploit may cause information exposure.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
HuaweiBerlin-l21hn Firmware Version < l21hnc185b381
   HuaweiBerlin-l21hn Version-
HuaweiPrague-al00a Firmware Version < al00ac00b223
   HuaweiPrague-al00a Version-
HuaweiPrague-al00b Firmware Version < al00bc00b223
   HuaweiPrague-al00b Version-
HuaweiPrague-al00c Firmware Version < al00cc00b223
   HuaweiPrague-al00c Version-
HuaweiPrague-l31 Firmware Version < l31c432b208
   HuaweiPrague-l31 Version-
HuaweiPrague-tl00a Firmware Version < tl00ac01b223
   HuaweiPrague-tl00a Version-
HuaweiPrague-tl10a Firmware Version < tl00ac01b223
   HuaweiPrague-tl10a Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.052
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.6 0.9 3.6
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.