deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8140
Published: 2017-11-22
Description: The soundtrigger driver in P9 Plus smart phones with software versions earlier than VIE-AL10BC00B353 has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170605-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170605-01-smartphone-en
CVE: CVE-2017-8141
Published: 2017-11-22
Description: The Touch Panel (TP) driver in P10 Plus smart phones with software versions earlier than VKY-AL00C00B153 has a memory double free vulnerability. An attacker with the root privilege of the Android system tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-smartphone-en
CVE: CVE-2017-8142
Published: 2017-11-22
Description: The Trusted Execution Environment (TEE) module driver of Mate 9 and Mate 9 Pro smart phones with software versions earlier than MHA-AL00BC00B221 and versions earlier than LON-AL00BC00B221 has a use after free (UAF) vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to create and free specific memory, which could triggers access memory after free it and causes a system crash or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170615-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170615-01-smartphone-en
CVE: CVE-2017-8143
Published: 2017-11-22
Description: Wi-Fi driver of Honor 5C and P9 Lite Huawei smart phones with software versions earlier than NEM-L21C432B351 and versions earlier than VNS-L21C10B381 has a DoS vulnerability. An attacker may trick a user into installing a malicious application and the application can access invalid address of driver to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170623-01-smartphone-en; http://www.securityfocus.com/bid/99256; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170623-01-smartphone-en
CVE: CVE-2017-8144
Published: 2017-11-22
Description: Honor 5A,Honor 8 Lite,Mate9,Mate9 Pro,P10,P10 Plus Huawei smartphones with software the versions before CAM-L03C605B143CUSTC605D003,the versions before Prague-L03C605B161,the versions before Prague-L23C605B160,the versions before MHA-AL00C00B225,the versions before LON-AL00C00B225,the versions before VTR-AL00C00B167,the versions before VTR-TL00C01B167,the versions before VKY-AL00C00B167,the versions before VKY-TL00C01B167 have a resource exhaustion vulnerability due to configure setting. An attacker tricks a user into installing a malicious application, the application may turn on the device flash-light and rapidly drain the device battery.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-920
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-01-smartphone-en
CVE: CVE-2017-8145
Published: 2017-11-22
Description: The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167, versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-02-smartphone-en
CVE: CVE-2017-8146
Published: 2017-11-22
Description: The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167, versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-02-smartphone-en
CVE: CVE-2017-8147
Published: 2017-11-22
Description: AC6005 V200R006C10SPC200,AC6605 V200R006C10SPC200,AR1200 with software V200R005C10CP0582T, V200R005C10HP0581T, V200R005C20SPC026T,AR200 with software V200R005C20SPC026T,AR3200 V200R005C20SPC026T,CloudEngine 12800 with software V100R003C00, V100R005C00, V100R005C10, V100R006C00, V200R001C00,CloudEngine 5800 with software V100R003C00, V100R005C00, V100R005C10, V100R006C00, V200R001C00,CloudEngine 6800 with software V100R003C00, V100R005C00, V100R005C10, V100R006C00, V200R001C00,CloudEngine 7800 with software V100R003C00, V100R005C00, V100R005C10, V100R006C00, V200R001C00,CloudEngine 8800 with software V100R006C00, V200R001C00,E600 V200R008C00,S12700 with software V200R005C00, V200R006C00, V200R007C00, V200R008C00,S1700 with software V100R006C00, V100R007C00, V200R006C00,S2300 with software V100R005C00, V100R006C00, V100R006C03, V100R006C05, V200R003C00, V200R003C02, V200R003C10, V200R005C00, V200R005C01, V200R005C02, V200R005C03, V200R006C00, V200R007C00, V200R008C00,S2700 with software V100R005C00, V100R006C00, V100R006C03, V100R006C05, V200R003C00, V200R003C02, V200R003C10, V200R005C00, V200R005C01, V200R005C02, V200R005C03, V200R006C00, V200R007C00, V200R008C00,S5300 with software V100R005C00, V100R006C00, V100R006C01, V200R001C00, V200R001C01, V200R002C00, V200R003C00, V200R003C02, V200R003C10, V200R005C00, V200R006C00, V200R007C00, V200R008C00,S5700 with software V100R005C00, V100R006C00, V100R006C01, V200R001C00, V200R001C01, V200R002C00, V200R003C00, V200R003C02, V200R003C10, V200R005C00, V200R006C00, V200R007C00, V200R008C00,S6300 with software V100R006C00, V200R001C00, V200R001C01, V200R002C00, V200R003C00, V200R003C02, V200R003C10, V200R005C00, V200R008C00,S6700 with software V100R006C00, V200R001C00, V200R001C01, V200R002C00, V200R003C00, V200R003C02, V200R003C10, V200R005C00, V200R006C00, V200R007C00, V200R008C00,S7700 with software V100R003C00, V100R006C00, V200R001C00, V200R001C01, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00,S9300 with software V100R001C00, V100R002C00, V100R003C00, V100R006C00, V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R008C10,S9700 with software V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00,Secospace USG6600 V500R001C00SPC050 have a MaxAge LSA vulnerability due to improper OSPF implementation. When the device receives special LSA packets, the LS (Link Status) age would be set to MaxAge, 3600 seconds. An attacker can exploit this vulnerability to poison the route table and launch a DoS attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170720-01-ospf-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170720-01-ospf-en
CVE: CVE-2017-8148
Published: 2017-11-22
Description: Audio driver in P9 smartphones with software The versions before EVA-AL10C00B389 has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application on the smart phone, and the race condition cause null pointer accessing during the application access shared resource, which make the system reboot.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170802-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170802-01-smartphone-en
CVE: CVE-2017-8149
Published: 2017-11-22
Description: The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the versions before Victoria-L29AC605B162, the versions before Vicky-L29AC605B162 have an out-of-bounds memory access vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. the APP can modify specific data to cause buffer overflow in the next system reboot, causing out-of-bounds memory read which can continuous system reboot.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170816-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170816-01-smartphone-en
CVE: CVE-2017-8150
Published: 2017-11-22
Description: The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the versions before Victoria-L29AC605B162, the versions before Vicky-L29AC605B162 have an arbitrary memory write vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause arbitrary memory writing in the next system reboot, causing continuous system reboot or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170816-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170816-02-smartphone-en
CVE: CVE-2017-8151
Published: 2017-11-22
Description: Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have an authentication bypass vulnerability due to the improper design of some components. An attacker can get a user's smart phone and install malicious apps in the mobile phone, allowing the attacker to reset the password and fingerprint of the phone without authentication.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170816-03-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170816-03-smartphone-en
CVE: CVE-2017-8152
Published: 2017-11-22
Description: Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have a Factory Reset Protection (FRP) bypass security vulnerability due to the improper design. An attacker can access factory reset page without authorization by only dial with special code. The attacker can exploit this vulnerability to restore the phone to factory settings.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-358
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170901-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170901-02-smartphone-en
CVE: CVE-2017-8153
Published: 2017-11-22
Description: Huawei VMall (for Android) with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design. An attacker can trick users into installing a malicious app which can send out HTTP requests and execute JavaScript code in web pages without obtaining the Internet access permission. Successful exploit could lead to resource occupation or information leak.
CVSS Score: 7.1 (HIGH)
CWE: CWE-275
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170901-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170901-01-smartphone-en
CVE: CVE-2017-8155
Published: 2017-11-22
Description: The outdoor unit of Customer Premise Equipment (CPE) product B2338-168 V100R001C00 has a no authentication vulnerability on a certain port. After accessing the network between the indoor and outdoor units of the CPE, an attacker can deliver commands to the specific port of the outdoor unit and execute them without authentication. Successful exploit could allow the attacker to take control over the outdoor unit.
CVSS Score: 8.4 (HIGH)
CWE: CWE-306
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170920-01-cpe-en; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170920-01-cpe-en
CVE: CVE-2017-8156
Published: 2017-11-22
Description: The outdoor unit of Customer Premise Equipment (CPE) product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port. An attacker can access the serial port on the circuit board of the outdoor unit and log in to the CPE without authentication. Successful exploit could allow the attacker to take control over the outdoor unit.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170920-01-cpe-en; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170920-01-cpe-en
CVE: CVE-2017-8157
Published: 2017-11-22
Description: OceanStor 5800 V3 with software V300R002C00 and V300R002C10, OceanStor 6900 V3 V300R001C00 has an information leakage vulnerability. Products use TLS1.0 to encrypt. Attackers can exploit TLS1.0's vulnerabilities to decrypt data to obtain sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-oceanstor-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-oceanstor-en
CVE: CVE-2017-8158
Published: 2017-11-22
Description: FusionCompute V100R005C00 and V100R005C10 have an improper authorization vulnerability due to improper permission settings for a certain file on the host machine. An authenticated attacker could create a large number of virtual machine (VM) processes to exhaust system resources. Successful exploit could make new VMs unavailable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170927-01-dos-en; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170927-01-dos-en
CVE: CVE-2017-8159
Published: 2017-11-22
Description: Some Huawei smartphones with software AGS-L09C233B019,AGS-W09C233B019,KOB-L09C233B017,KOB-W09C233B012 have a type confusion vulnerability. The program initializes a variable using one type, but it later accesses that variable using a type that is different with the original type when do certain register operation. Successful exploit could result in buffer overflow then may cause malicious code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171018-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171018-02-smartphone-en
CVE: CVE-2017-8160
Published: 2017-11-22
Description: The Madapt Driver of some Huawei smart phones with software Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than Victoria-AL00AC00B172 versions,Victoria-TL00AC00B123,Victoria-TL00AC01B167 has a use after free (UAF) vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability, Successful exploitation may cause arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-smartphone-en
CVE: CVE-2017-8161
Published: 2017-11-22
Description: EVA-L09 smartphones with software Earlier than EVA-L09C25B150CUSTC25D003 versions,Earlier than EVA-L09C440B140 versions,Earlier than EVA-L09C464B361 versions,Earlier than EVA-L09C675B320CUSTC675D004 versions have Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the Swype and can perform some operations to update the Google account. As a result, the FRP function is bypassed.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-668
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171013-01-frpbypass-en; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171013-01-frpbypass-en
CVE: CVE-2017-8162
Published: 2017-11-22
Description: AR120-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR1200 with software V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR1200-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR150 with software V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR150-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR160 with software V200R006C10, V200R006C12, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR200 with software V200R006C10, V200R007C00, V200R007C01, V200R008C20, V200R008C30,AR200-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR2200 with software V200R006C10, V200R006C13, V200R006C16PWE, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR2200-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30,AR510 with software V200R006C10, V200R006C12, V200R006C13, V200R006C15, V200R006C16, V200R006C17, V200R007C00, V200R008C20, V200R008C30,NetEngine16EX with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,SMC2.0 with software V100R003C10, V100R005C00, V500R002C00, V600R006C00,SRG1300 with software V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30,SRG2300 with software V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30,SRG3300 with software V200R006C10, V200R007C00, V200R008C20, V200R008C30 have a DoS vulnerability. Due to incorrect malformed message processing logic, an authenticated, remote attacker could send specially crafted message to the target device.Successful exploit of the vulnerability could cause stack overflow and make a service unavailable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-h323-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-h323-en
CVE: CVE-2017-8163
Published: 2017-11-22
Description: AR120-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR1200 with software V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR1200-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR150 with software V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR150-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR160 with software V200R006C10, V200R006C12, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR200 with software V200R006C10, V200R007C00, V200R007C01, V200R008C20, V200R008C30,AR200-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR2200 with software V200R006C10, V200R006C13, V200R006C16PWE, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR2200-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30,AR510 with software V200R006C10, V200R006C12, V200R006C13, V200R006C15, V200R006C16, V200R006C17, V200R007C00, V200R008C20, V200R008C30,NetEngine16EX with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,SMC2.0 with software V100R003C10, V100R005C00, V500R002C00, V600R006C00,SRG1300 with software V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30,SRG2300 with software V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30,SRG3300 with software V200R006C10, V200R007C00, V200R008C20, V200R008C30 have an out-of-bounds read vulnerability. Due to insufficient input validation, an authenticated, remote attacker could send specially crafted message to the target device.Successful exploit of the vulnerability could cause out-of-bounds read and system crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-h323-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-h323-en
CVE: CVE-2017-8166
Published: 2017-11-22
Description: Huawei mobile phones Honor V9 with the software versions before Duke-AL20C00B195 have an App Lock bypass vulnerability. An attacker could perform specific operations to bypass the App Lock to use apps on a target mobile phone.
CVSS Score: 6.8 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171019-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171019-01-smartphone-en
CVE: CVE-2017-8167
Published: 2017-11-22
Description: Huawei firewall products USG9500 V500R001C50 has a DoS vulnerability.A remote attacker who controls the peer device could exploit the vulnerability by sending malformed IKE packets to the target device. Successful exploit of the vulnerability could cause the device to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-firewall-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-firewall-en
CVE: CVE-2017-8168
Published: 2017-11-22
Description: FusionSphere OpenStack with software V100R006C00SPC102(NFV) and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive information transmitted.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-311
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-openstack-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-openstack-en
CVE: CVE-2017-8169
Published: 2017-11-22
Description: Huawei smart phones with software earlier than VIE-L09C40B360 versions have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the smart phone, causing the smartphone restart or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-overflow-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-overflow-en
CVE: CVE-2017-8170
Published: 2017-11-22
Description: Huawei smart phones with software earlier than VIE-L09C40B360 versions have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the smart phone, causing the smartphone restart or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-overflow-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-overflow-en