CVE-2018-7910

{"id": "CVE-2018-7910", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2018-11-13T19:29:00.400", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181101-01-bypass-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128(C432), 8.0.0.137(C432), BLA-L29C 8.0.0.129(C432), 8.0.0.137(C432) have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the vulnerability can be used to replace the start-up program so that the attacker can obtain the information in the smartphone and achieve the purpose of controlling the smartphone."}, {"lang": "es", "value": "Algunos smartphones Huawei ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128(C432), 8.0.0.137(C432), BLA-L29C 8.0.0.129(C432) y 8.0.0.137(C432) tienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n. Cuando el atacante obtiene el smartphone del usuario, la vulnerabilidad se puede emplear para reemplazar el programa de arranque para que el atacante pueda obtener la informaci\u00f3n en el smartphone y lograr controlarlo."}], "lastModified": "2018-12-12T20:39:48.720", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:alp-al00b_firmware:8.0.0.1.18d\\(c00\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D327AD65-437A-4DA9-B38E-FFE9147AAB82"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:alp-al00b:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0FA2B2F1-3D58-4DC7-AB7A-28BF8B282333"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:alp-tl00b_firmware:8.0.0.1.18d\\(c01\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "439861D3-3F70-4A8C-A2F0-99120207E3CF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:alp-tl00b:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E7918CD6-341B-4FCC-BD31-30B8952192C8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:bla-al00b_firmware:8.0.0.1.18d\\(c00\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06F0F9A3-BC44-463E-BF84-593CAC5CBB45"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:bla-al00b:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B11D6D9B-335B-404C-88F3-590DF9E5D878"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:bla-l09c_firmware:8.0.0.127\\(c432\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2CADEF0-2830-4883-8B52-4BCE6B74DBF4"}, {"criteria": "cpe:2.3:o:huawei:bla-l09c_firmware:8.0.0.128\\(c432\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4C168E2-2679-478D-815F-FD909FBE1B38"}, {"criteria": "cpe:2.3:o:huawei:bla-l09c_firmware:8.0.0.137\\(c432\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87AC6AB6-B166-4098-98E1-79A6407DAFA5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:bla-l09c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3C787E52-055B-4931-9B5C-604F1578A3A0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:bla-l29c_firmware:8.0.0.127\\(c432\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD8BD839-9468-4F62-A66B-25C1AF032D05"}, {"criteria": "cpe:2.3:o:huawei:bla-l29c_firmware:8.0.0.137\\(c432\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "641C18E2-CB4A-4169-B836-B4CD171248EC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:bla-l29c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "551386D1-3D02-4319-B2A2-1AAE80F7F249"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}