CVE-2017-2704

Published: Nov 22, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Smarthome 1.0.2.364 and earlier versions,HiAPP 7.3.0.303 and earlier versions,HwParentControl 2.0.0 and earlier versions,HwParentControlParent 5.1.0.12 and earlier versions,Crowdtest 1.5.3 and earlier versions,HiWallet 8.0.0.301 and earlier versions,Huawei Pay 8.0.0.300 and earlier versions,Skytone 8.1.2.300 and earlier versions,HwCloudDrive(EMUI6.0) 8.0.0.307 and earlier versions,HwPhoneFinder(EMUI6.0) 9.3.0.310 and earlier versions,HwPhoneFinder(EMUI5.1) 9.2.2.303 and earlier versions,HiCinema 8.0.2.300 and earlier versions,HuaweiWear 21.0.0.360 and earlier versions,HiHealthApp 3.0.3.300 and earlier versions have an information exposure vulnerability. Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys, causing information exposure.

Affected (14)

Products: Huawei: Smarthome, Hiapp, Hwparentcontrol, Hwparentcontrolparent, Crowdtest, Hiwallet, Huawei Pay, Skytone, Hwclouddrive(emui6.0), Hwphonefinder(emui6.0), Hwphonefinder(emui5.1), Hicinema, Huaweiwear, Hihealthapp

14 products

Hwparentcontrolparent

Hwclouddrive(emui6.0)

Hwphonefinder(emui6.0)

Hwphonefinder(emui5.1)

Hicinema

Huaweiwear

Hihealthapp

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Smarthome	version ≤ 1.0.2.364

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Hiapp	version ≤ 7.3.0.303

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Hwparentcontrol	version ≤ 2.0.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Hwparentcontrolparent	version ≤ 5.1.0.12

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Crowdtest	version ≤ 1.5.3

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Hiwallet	version ≤ 8.0.0.301

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Huawei Pay	version ≤ 8.0.0.300

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Skytone	version ≤ 8.1.2.300

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Hwclouddrive(emui6.0)	version ≤ 8.0.0.307

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Hwphonefinder(emui6.0)	version ≤ 9.3.0.310

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Hwphonefinder(emui5.1)	version ≤ 9.2.2.303

Configuration L

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Hicinema	version ≤ 8.0.2.300

Configuration M

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Huaweiwear	version ≤ 21.0.0.360

Configuration N

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Hihealthapp	version ≤ 3.0.3.300

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-encryption-en

Source: psirt@huawei.com

Vendor Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-encryption-en

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.