CVE-2018-7947

{"id": "CVE-2018-7947", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.9, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 0.5}]}, "published": "2018-07-31T14:29:00.980", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180720-01-mobile-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause some malicious applications to be installed in the mobile phones."}, {"lang": "es", "value": "Los tel\u00e9fonos m\u00f3viles Huawei con versiones anteriores a Emily-AL00A 8.1.0.153(C00) tienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n. Un atacante puede enga\u00f1ar a un usuario para que se conecte a un dispositivo malicioso. En el modo de depuraci\u00f3n, el software malicioso en el dispositivo podr\u00eda explotar la vulnerabilidad para omitir algunas funciones espec\u00edficas. Su explotaci\u00f3n con \u00e9xito podr\u00eda provocar que algunas aplicaciones se instalen en los tel\u00e9fonos m\u00f3viles."}], "lastModified": "2018-10-04T21:39:25.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:emily-al00a_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C89D2623-A661-4837-B0DC-BEC6802B8895", "versionEndExcluding": "8.1.0.153\\(c00\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:emily-al00a:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8AC84A74-7F01-4434-896C-B9B595984F23"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}