CVE-2017-17149 Auth bypass in Huawei HiWallet App
An attacker with root access can bypass Huawei ID verification to arbitrarily change the lock pattern of the HiWallet application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-17149?
CVE-2017-17149 is a low-severity authentication bypass vulnerability in Huawei HiWallet App, published on 9 Mar 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Huawei HiWallet App with the versions before 8.0.4 has an arbitrary lock pattern change vulnerability. It needs to verify the user's Huawei ID during lock pattern change. An attacker with root privilege who gets a user's smart phone may bypass Huawei ID verification by special operation. Successful exploit of this vulnerability can allow an attacker to change the lock pattern of HiWallet.
Which versions are affected by CVE-2017-17149?
It affects 1 product.
Products include Huawei Hiwallet.
How do I fix CVE-2017-17149?
No fix has been published for CVE-2017-17149 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-17149 being exploited?
There is no known exploitation of CVE-2017-17149 in the wild and no public exploit code.
Other vulnerabilities in Huawei HiWallet App
Sources
Also known as GHSA-8fvm-8w45-c4j7.