cbcvebase.
CVE-2018-7911
published 2018-10-23

CVE-2018-7911: Some Huawei smart phones ALP-AL00B 8.0.0.106(C00), 8.0.0.113(SP2C00), 8.0.0.113(SP3C00), 8.0.0.113(SP7C00), 8.0.0.118(C00), 8.0.0.120(SP2C00)…

PriorityP418medium4.6CVSS 3.0
AVPACLPRNUINSUCNIHAN
EPSS
0.24%
14.6th percentile
Some Huawei smart phones ALP-AL00B 8.0.0.106(C00), 8.0.0.113(SP2C00), 8.0.0.113(SP3C00), 8.0.0.113(SP7C00), 8.0.0.118(C00), 8.0.0.120(SP2C00), 8.0.0.125(SP1C00), 8.0.0.125(SP3C00), 8.0.0.126(SP2C00), 8.0.0.126(SP5C00), 8.0.0.127(SP1C00), 8.0.0.128(SP2C00), ALP-AL00B-RSC 1.0.0.2, BLA-TL00B 8.0.0.113(SP7C01), 8.0.0.118(C01), 8.0.0.120(SP2C01), 8.0.0.125(SP1C01), 8.0.0.125(SP2C01), 8.0.0.125(SP3C01), 8.0.0.126(SP2C01), 8.0.0.126(SP5C01), 8.0.0.127(SP1C01), 8.0.0.128(SP2C01), 8.0.0.129(SP2C01), Charlotte-AL00A 8.1.0.105(SP7C00), 8.1.0.106(SP3C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP3C00), 8.1.0.108(SP6C00), 8.1.0.109(SP2C00), Emily-AL00A 8.1.0.105(SP6C00), 8.1.0.106(SP2C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP2C00), 8.1.0.108(SP6C00), 8.1.0.109(SP5C00) have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by Gaode Map and can perform some operations to update the Google account. As a result, the FRP function is bypassed.

Affected

38 ranges· showing 25
VendorProductVersion rangeFixed in
huaweialp-al00b-rsc_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweialp-al00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweibla-tl00b_firmware——
huaweicharlotte-al00a_firmware——

CVSS provenance

nvdv3.04.6MEDIUMCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:C/A:N
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.