CVE-2018-7947 Auth bypass in Emily-AL00A
Attackers can bypass authentication in debug mode to install malicious applications on Huawei mobile phones.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-7947?
CVE-2018-7947 is a low-severity authentication bypass vulnerability in Huawei Technologies Co., Ltd. Emily-AL00A, published on 31 Jul 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause some malicious applications to be installed in the mobile phones.
Weakness: CWE-287
Which versions are affected by CVE-2018-7947?
It affects 1 product.
Products include Huawei Emily-Al00a Firmware.
How do I fix CVE-2018-7947?
No fix has been published for CVE-2018-7947 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-7947 being exploited?
There is no known exploitation of CVE-2018-7947 in the wild and no public exploit code.
Other vulnerabilities in Huawei Technologies Co., Ltd. Emily-AL00A
Sources
Also known as GHSA-p4wm-rj32-63x3.