CVE-2017-15325
High
Description
The Bdat driver of Prague smart phones with software versions earlier than Prague-AL00AC00B211, versions earlier than Prague-AL00BC00B211, versions earlier than Prague-AL00CC00B211, versions earlier than Prague-TL00AC01B211, versions earlier than Prague-TL10AC01B211 has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP and execute it as a specific privilege; the APP can then send a specific parameter to the driver of the smart phone, causing arbitrary code execution.
SeverityHigh
CVSS7.8
Exploit probability—
ProductHuawei Prague-al00a Firmware
PublishedMar 23, 2018
First seenMar 23, 2018
How to fix
Update
- huawei prague-al00a_firmwareprague-al00ac00b211 or later
- huawei prague-al00b_firmwareprague-al00bc00b211 or later
- huawei prague-al00c_firmwareprague-al00cc00b211 or later
- huawei prague-tl00a_firmwareprague-tl00ac01b211 or later
- huawei prague-tl10a_firmwareprague-tl10ac01b211 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei prague-al00a_firmware | v < prague-al00ac00b211 | prague-al00ac00b211 |
| huawei prague-al00b_firmware | v < prague-al00bc00b211 | prague-al00bc00b211 |
| huawei prague-al00c_firmware | v < prague-al00cc00b211 | prague-al00cc00b211 |
| huawei prague-tl00a_firmware | v < prague-tl00ac01b211 | prague-tl00ac01b211 |
| huawei prague-tl10a_firmware | v < prague-tl10ac01b211 | prague-tl10ac01b211 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.