CVE-2017-10709

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspace after each PIN guess.

Metrics

CVSS 3.0 6.8/10CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/Press/Media Coverage, Third Party Advisory
https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilenThird Party Advisory
https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707Third Party Advisory
https://www.trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0Third Party Advisory
https://www.youtube.com/watch?v=dwyzonP2eZwPress/Media Coverage, Third Party Advisory
https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/Press/Media Coverage, Third Party Advisory
https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilenThird Party Advisory
https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707Third Party Advisory
https://www.trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0Third Party Advisory
https://www.youtube.com/watch?v=dwyzonP2eZwPress/Media Coverage, Third Party Advisory

Timeline

Published: Jun 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-107116.1In SimpleRisk 20170614-001, a CSRF attack on reset.php (aka the Send Password Reset Email form) can insert XSS sequences via the user parame CVE-2017-107186.5Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that any malicious user CVE-2017-107196.5Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has def CVE-2017-107207.8Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop applic CVE-2017-107216.5Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Tel CVE-2017-107227.8Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop applic CVE-2017-107238.8Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connec CVE-2017-107248.8Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connec CVE-2017-107257.3Winamp 5.666 Build 3516(x86) allows attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related to "Da CVE-2017-107267.8Winamp 5.666 Build 3516(x86) might allow attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related t CVE-2017-107277.8Winamp 5.666 Build 3516(x86) might allow attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related t CVE-2017-107287.8Winamp 5.666 Build 3516(x86) might allow attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related t