CVE-2017-2730 Information disclosure in HUAWEI HiLink APP (for IOS), HUAWEI Tech Support APP (for IOS)
Attackers can collect iPhone model and firmware version information when users connect to a malicious Wi-Fi hotspot using vulnerable Huawei iOS apps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-2730?
CVE-2017-2730 is a low-severity vulnerability in HUAWEI HiLink APP (for IOS), HUAWEI Tech Support APP (for IOS), published on 22 Nov 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.
Weakness: CWE-200
Which versions are affected by CVE-2017-2730?
It affects 2 products.
Products include Huawei Hilink, Huawei Tech Support.
How do I fix CVE-2017-2730?
Upgrade to a fixed version.
Is CVE-2017-2730 being exploited?
There is no known exploitation of CVE-2017-2730 in the wild and no public exploit code.
Other vulnerabilities in HUAWEI HiLink APP (for IOS), HUAWEI Tech Support APP (for IOS)
Sources
Also known as GHSA-wgw9-hgw6-6jgc.