CVE-2017-2728 Auth bypass in Honor 6X
Attackers can bypass screen lock on Huawei Honor 6X devices by impersonating trusted Bluetooth devices if smart unlock is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-2728?
CVE-2017-2728 is a medium-severity authentication bypass vulnerability in Huawei Technologies Co., Ltd. Honor 6X, published on 22 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Some Huawei mobile phones Honor 6X Berlin-L22C636B150 and earlier versions have a Bluetooth unlock bypassing vulnerability. If a user has enabled the smart unlock function, an attacker can impersonate the user's Bluetooth device to unlock the user's mobile phone screen.uawei mobile phones have a Bluetooth unlock bypassing vulnerability due to the lack of validation on Bluetooth devices. If a user has enabled the smart unlock function, an attacker can impersonate the user's Bluetooth device to unlock the user's mobile phone screen.
Which versions are affected by CVE-2017-2728?
It affects 1 product.
Products include Huawei Honor 6x Firmware.
How do I fix CVE-2017-2728?
No fix has been published for CVE-2017-2728 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-2728 being exploited?
There is no known exploitation of CVE-2017-2728 in the wild and no public exploit code.
Other vulnerabilities in Huawei Technologies Co., Ltd. Honor 6X
Sources
Also known as GHSA-r7mp-gqfh-q2fr.