CVE-2018-7940 Auth bypass in HUAWEI Mate 10, HUAWEI Mate 10 Pro

What is CVE-2018-7940?

CVE-2018-7940 is a medium-severity authentication bypass vulnerability in HUAWEI Mate 10, HUAWEI Mate 10 Pro, published on 10 May 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.0.129(SP2C01) have an authentication bypass vulnerability. An attacker with high privilege obtains the smart phone and bypass the activation function by some specific operations.

Weakness: CWE-287

Which versions are affected by CVE-2018-7940?

It affects 2 products.

Products include Huawei Mate 9 Firmware, Huawei Mate 9 Pro Firmware.

How do I fix CVE-2018-7940?

No fix has been published for CVE-2018-7940 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-7940 being exploited?

There is no known exploitation of CVE-2018-7940 in the wild and no public exploit code.

Other vulnerabilities in HUAWEI Mate 10, HUAWEI Mate 10 Pro

• CVE-2017-15316 Use after free in Mate 9 High 7.8
• CVE-2017-2716 Memory corruption in Mate 9 High 7.8
• CVE-2017-8142 Use after free in Mate 9, Mate 9 Pro High 7.8
• CVE-2017-2706 Path traversal in Mate 9 High 7.1
• CVE-2017-2707 Privilege escalation in Mate 9 High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vqm5-7rwj-fpcv.