vulnwire
5.5med

CVE-2017-8202

The CameraISP driver of some Huawei smart phones with software of versions earlier than Prague-AL00AC00B205,versions earlier than Prague-AL…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 53%
Public exploits
0
none known

The CameraISP driver of some Huawei smart phones with software of versions earlier than Prague-AL00AC00B205,versions earlier than Prague-AL00BC00B205,versions earlier than Prague-AL00CC00B205,versions earlier than Prague-TL00AC01B205,versions earlier than Prague-TL10AC01B205 has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP, the APP can send a specific parameter to the CameraISP driver of the smart phone, causing system reboot.

Exploit prediction (EPSS)

0.70% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD2.07.1AV:N/AC:M/Au:N/C:N/I:N/A:C

Affected products

  • Huawei Technologies Co., Ltd. Prague-AL00A,Prague-AL00B,Prague-AL00C,Prague-TL00A,Prague-TL10A

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • huawei.com /en/psirt/security-advisories/huawei-sa-20171115-01-smartphone-en · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/101959 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.