CVE-2017-2721

Published: Nov 22, 2017Modified: May 13, 2026

4.6

Vector

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 0.9 / Impact: 3.6

Source: NVD

Description

Some Huawei smart phones with software Berlin-L21C10B130,Berlin-L21C185B133,Berlin-L21HNC10B131,Berlin-L21HNC185B140,Berlin-L21HNC432B151,Berlin-L22C636B160,Berlin-L22HNC636B130,Berlin-L22HNC675B150CUSTC675D001,Berlin-L23C605B131,Berlin-L24HNC567B110,FRD-L02C432B120,FRD-L02C635B130,FRD-L02C675B170CUSTC675D001,FRD-L04C567B162,FRD-L04C605B131,FRD-L09C10B130,FRD-L09C185B130,FRD-L09C432B131,FRD-L09C636B130,FRD-L14C567B162,FRD-L19C10B130,FRD-L19C432B131,FRD-L19C636B130 have a factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by Swype Keyboard and can perform some operations to update the Google account. As a result, the FRP function is bypassed.

Affected (23)

Products: Huawei: Berlin L21 Firmware, Berlin L21hn Firmware, Berlin L22 Firmware, Berlin L22hn Firmware, Berlin L23 Firmware, Berlin L24hn Firmware, Frd L02 Firmware, Frd L04 Firmware, Frd L09 Firmware, Frd L14 Firmware, Frd L19 Firmware

Huawei

11 products

Berlin L21 Firmware

Berlin L21hn Firmware

Berlin L22 Firmware

Berlin L22hn Firmware

Berlin L23 Firmware

Berlin L24hn Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Berlin L21 Firmware	Version berlin-l21c10b130
Huawei Berlin L21 Firmware	Version berlin-l21c185b133

Running on/with	Platform Versions
Huawei Berlin L21	All versions

Configuration B

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Berlin L21hn Firmware	Version berlin-l21hnc10b131
Huawei Berlin L21hn Firmware	Version berlin-l21hnc185b140
Huawei Berlin L21hn Firmware	Version berlin-l21hnc432b151

Running on/with	Platform Versions
Huawei Berlin L21hn	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Berlin L22 Firmware	Version berlin-l22c636b160

Running on/with	Platform Versions
Huawei Berlin L22	All versions

Configuration D

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Berlin L22hn Firmware	Version berlin-l22hnc636b130
Huawei Berlin L22hn Firmware	Version berlin-l22hnc675b150custc675d001

Running on/with	Platform Versions
Huawei Berlin L22hn	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Berlin L23 Firmware	Version berlin-l23c605b131

Running on/with	Platform Versions
Huawei Berlin L23	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Berlin L24hn Firmware	Version berlin-l24hnc567b110

Running on/with	Platform Versions
Huawei Berlin L24hn	All versions

Configuration G

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Frd L02 Firmware	Version frd-l02c432b120
Huawei Frd L02 Firmware	Version frd-l02c635b130
Huawei Frd L02 Firmware	Version frd-l02c675b170custc675d001

Running on/with	Platform Versions
Huawei Frd L02	All versions

Configuration H

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Frd L04 Firmware	Version frd-l04c567b162
Huawei Frd L04 Firmware	Version frd-l04c605b131

Running on/with	Platform Versions
Huawei Frd L04	All versions

Configuration I

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Frd L09 Firmware	Version frd-l09c10b130
Huawei Frd L09 Firmware	Version frd-l09c185b130
Huawei Frd L09 Firmware	Version frd-l09c432b131
Huawei Frd L09 Firmware	Version frd-l09c636b130

Running on/with	Platform Versions
Huawei Frd L09	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Frd L14 Firmware	Version frd-l14c567b162

Running on/with	Platform Versions
Huawei Frd L14	All versions

Configuration K

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Frd L19 Firmware	Version frd-l19c10b130
Huawei Frd L19 Firmware	Version frd-l19c432b131
Huawei Frd L19 Firmware	Version frd-l19c636b130

Running on/with	Platform Versions
Huawei Frd L19	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-frpbypass-en

Source: psirt@huawei.com

Issue TrackingVendor Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-frpbypass-en

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.