CVE-2017-2730

HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.

CVSS v3 3.5 LOW
CVSS v2.0 2.9 LOW

3.5^/10

CVSS v3 : LOW

Vector : AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability : 2.1 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.9^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 5.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170310-01-hilinkapp-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:huawei:hilink::::::::
	cpe:2.3:a:huawei:tech_support::::::::

cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-11-22 19:29

Updated : 2024-02-28 16:04

NVD link : CVE-2017-2730

Mitre link : CVE-2017-2730

CVE.ORG link : CVE-2017-2730

JSON object : View

Products Affected

huawei

tech_support
hilink

apple

iphone_os

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2017-2730", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.9, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2017-11-22T19:29:01.740", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170310-01-hilinkapp-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version."}, {"lang": "es", "value": "HUAWEI HiLink APP (para IOS) en versiones anteriores a la 5.0.25.306 y HUAWEI Tech Support APP (para IOS) en versiones anteriores a la 5.0.0 tienen una vulnerabilidad de filtrado de informaci\u00f3n. Cuando un iPhone con estas apps instaladas accede al hotspot wifi establecido por el atacante, el atacante puede recopilar la informaci\u00f3n sobre el modelo y la versi\u00f3n de firmware del iPhone."}], "lastModified": "2017-12-11T17:30:45.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:huawei:hilink:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B82D912-DFCD-4030-A927-CA66AAB92B93", "versionEndExcluding": "5.0.25.306"}, {"criteria": "cpe:2.3:a:huawei:tech_support:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BCF4E24-7B92-4094-B6FE-60A82F477920", "versionEndExcluding": "5.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B5415705-33E5-46D5-8E4D-9EBADC8C5705"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}