CVE-2017-2708

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

The 'Find Phone' function in Nice smartphones with software versions earlier before Nice-AL00C00B0135 has an authentication bypass vulnerability. An unauthenticated attacker may wipe and factory reset the phone by special steps. Due to missing authentication of the 'Find Phone' function, an attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally.

Metrics

CVSS 3.0 4.6/10CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Huawei Technologies Co., Ltd.	Nice	Versions earlier before Nice-AL00C00B0135

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170125-01-smartphone-enIssue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/95911Third Party Advisory, VDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170125-01-smartphone-enIssue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/95911Third Party Advisory, VDB Entry

Timeline

Published: Nov 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-27095.5HiGame with software earlier than 7.3.0 versions, SkyTone with software earlier than 8.1.1 versions have a DoS Vulnerability. An attacker tr CVE-2017-27104.6BTV-W09C229B002CUSTC229D005,BTV-W09C233B029, earlier than BTV-W09C100B006CUSTC100D002 versions, earlier than BTV-W09C128B003CUSTC128D002 ver CVE-2017-27115.5P9 Plus smartphones with software earlier than VIE-AL10C00B352 versions have an input validation vulnerability in the touchscreen Driver. An CVE-2017-27125.3S3300 V100R006C05 have an Ethernet in the First Mile (EFM) flapping vulnerability due to the lack of type-length-value (TLV) consistency che CVE-2017-27135.4HUAWEI P9 smartphones with software versions earlier before EVA-L09C432B383, versions earlier before EVA-L09C636B380, versions earlier befor CVE-2017-27148.0The GaussDB in FusionSphere OpenStack V100R005C10SPC705 and earlier versions has a buffer overflow vulnerability. An authenticated attacker CVE-2017-27157.8The Files APP 7.1.1.309 and earlier versions in some Huawei mobile phones has a brute-force password cracking vulnerability due to the impro CVE-2017-27167.8The camerafs driver in Mate 9 Versions earlier than MHA-AL00BC00B173 has buffer overflow vulnerability. An attacker tricks a user into insta CVE-2017-27176.5honor 8 Pro with software Duke-L09C10B120 and earlier versions,Duke-L09C432B120 and earlier versions,Duke-L09C636B120 and earlier versions h CVE-2017-27188.8FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input CVE-2017-27198.8FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input CVE-2017-27205.3FusionSphere OpenStack V100R006C00 has an information exposure vulnerability. The software uses hard-coded cryptographic key to encrypt mess