CVE-2017-17158
Last modified
CVE-2017-17158 is a vulnerability of currently unknown severity. Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prague-TL00AC01B223 have an information exposure vulnerability. When the user's smart phone connects to the malicious device for charging, an unauthenticated attacker may activate some specific function by sending some specially crafted messages. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prague-TL00AC01B223 have an information exposure vulnerability. When the user's smart phone connects to the malicious device for charging, an unauthenticated attacker may activate some specific function by sending some specially crafted messages. Due to insufficient input validation of the messages, successful exploit may cause information exposure.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Huawei | Berlin-L21hn Firmware | < l21hnc185b381 |
| Huawei | Prague-Al00a Firmware | < al00ac00b223 |
| Huawei | Prague-Al00b Firmware | < al00bc00b223 |
| Huawei | Prague-Al00c Firmware | < al00cc00b223 |
| Huawei | Prague-L31 Firmware | < l31c432b208 |
| Huawei | Prague-Tl00a Firmware | < tl00ac01b223 |
| Huawei | Prague-Tl10a Firmware | < tl00ac01b223 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-17158?
How severe is CVE-2017-17158?
How do I fix CVE-2017-17158?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-17152IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V…
- CVE-2017-17153IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V…
- CVE-2017-17154IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V…
- CVE-2017-17155IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V…
- CVE-2017-17156IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V…
- CVE-2017-17157IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V…
- CVE-2017-17159Some Huawei smart phones with software of NXT-AL10C00B386, N…
- CVE-2017-1716IBM Tivoli Workload Scheduler 8.6.0, 9.1.0, and 9.2.0 could …
- CVE-2017-17160Huawei AR120-S V200R006C10, V200R007C00, AR1200 V200R006C10,…
- CVE-2017-17161The 'Find Phone' function in some Huawei smart phones with s…
- CVE-2017-17162Huawei Secospace USG6600 V500R001C30SPC100, Secospace USG660…
- CVE-2017-17163Huawei Secospace USG6600 V500R001C30SPC100 has an Out-of-Bou…
Are you affected by CVE-2017-17158?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST