CVE-2017-2691
Last modified
CVE-2017-2691 is a vulnerability of currently unknown severity. Huawei P9 versions earlier before EVA-AL10C00B373, versions earlier before EVA-CL00C92B373, versions earlier before EVA-DL00C17B373, versions earlier before EVA-TL00C01B373 have a lock-screen bypass vulnerability. An unauthenticated attacker could force the phone to the fastboot mode and delete the user's password file during the reboot process, then login the phone without screen lock password after reboot.. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Huawei P9 versions earlier before EVA-AL10C00B373, versions earlier before EVA-CL00C92B373, versions earlier before EVA-DL00C17B373, versions earlier before EVA-TL00C01B373 have a lock-screen bypass vulnerability. An unauthenticated attacker could force the phone to the fastboot mode and delete the user's password file during the reboot process, then login the phone without screen lock password after reboot.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Huawei | P9 Firmware | < eva-tl00c01b373 |
| Huawei | P9 Firmware | < eva-dl00c17b373 |
| Huawei | P9 Firmware | < eva-cl00c92b373 |
| Huawei | P9 Firmware | < eva-al10c00b373 |
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170118-01-smartphone-enIssue Tracking, Vendor Advisory
- http://www.securityfocus.com/bid/95658Third Party Advisory, VDB Entry
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170118-01-smartphone-enIssue Tracking, Vendor Advisory
- http://www.securityfocus.com/bid/95658Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-2691?
How severe is CVE-2017-2691?
How do I fix CVE-2017-2691?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-2685Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00…
- CVE-2017-2686Siemens RUGGEDCOM ROX I (all versions) contain a vulnerabili…
- CVE-2017-2687Siemens RUGGEDCOM ROX I (all versions) contain a vulnerabili…
- CVE-2017-2688The integrated web server in Siemens RUGGEDCOM ROX I (all ve…
- CVE-2017-2689Siemens RUGGEDCOM ROX I (all versions) allow an authenticate…
- CVE-2017-2690SoftCo with software V200R003C20,eSpace U1910 with software …
- CVE-2017-2692The Keyguard application in ALE-L02C635B140 and earlier vers…
- CVE-2017-2693ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and ear…
- CVE-2017-2694The AlarmService component in HwVmall with software earlier …
- CVE-2017-2695TIT-AL00C583B211 has a directory traversal vulnerability whi…
- CVE-2017-2696The emerg_data driver in CAM-L21C10B130 and earlier versions…
- CVE-2017-2697The goldeneye driver in NMO-L31C432B120 and earlier versions…
Are you affected by CVE-2017-2691?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
