Details of VAR-201711-0220

ID

VAR-201711-0220

CVE

CVE-2017-2704

TITLE

plural Huawei Information disclosure vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-010794

DESCRIPTION

Smarthome 1.0.2.364 and earlier versions,HiAPP 7.3.0.303 and earlier versions,HwParentControl 2.0.0 and earlier versions,HwParentControlParent 5.1.0.12 and earlier versions,Crowdtest 1.5.3 and earlier versions,HiWallet 8.0.0.301 and earlier versions,Huawei Pay 8.0.0.300 and earlier versions,Skytone 8.1.2.300 and earlier versions,HwCloudDrive(EMUI6.0) 8.0.0.307 and earlier versions,HwPhoneFinder(EMUI6.0) 9.3.0.310 and earlier versions,HwPhoneFinder(EMUI5.1) 9.2.2.303 and earlier versions,HiCinema 8.0.2.300 and earlier versions,HuaweiWear 21.0.0.360 and earlier versions,HiHealthApp 3.0.3.300 and earlier versions have an information exposure vulnerability. Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys, causing information exposure. plural Huawei The product contains an information disclosure vulnerability.Information may be obtained. Huawei Smarthome, etc. are all products of China's Huawei (Huawei). Huawei Smarthome is a smart home management app. HiAPP is a dedicated technical knowledge consultant platform for Huawei mobile phones. Several Huawei products have an information disclosure vulnerability, which stems from the fact that the program stores encryption keys in the affected product software

Trust: 1.8

sources: NVD: CVE-2017-2704 // JVNDB: JVNDB-2017-010794 // VULHUB: VHN-110907 // VULMON: CVE-2017-2704

AFFECTED PRODUCTS

vendor:	huawei	model:	skytone	scope:	lte	version:	8.1.2.300	Trust: 1.0
vendor:	huawei	model:	hiapp	scope:	lte	version:	7.3.0.303	Trust: 1.0
vendor:	huawei	model:	crowdtest	scope:	lte	version:	1.5.3	Trust: 1.0
vendor:	huawei	model:	hiwallet	scope:	lte	version:	8.0.0.301	Trust: 1.0
vendor:	huawei	model:	hwphonefinder\	scope:	lte	version:	9.3.0.310	Trust: 1.0
vendor:	huawei	model:	hwphonefinder\	scope:	lte	version:	9.2.2.303	Trust: 1.0
vendor:	huawei	model:	smarthome	scope:	lte	version:	1.0.2.364	Trust: 1.0
vendor:	huawei	model:	hwparentcontrolparent	scope:	lte	version:	5.1.0.12	Trust: 1.0
vendor:	huawei	model:	hicinema	scope:	lte	version:	8.0.2.300	Trust: 1.0
vendor:	huawei	model:	hwclouddrive\	scope:	lte	version:	8.0.0.307	Trust: 1.0
vendor:	huawei	model:	hwparentcontrol	scope:	lte	version:	2.0.0	Trust: 1.0
vendor:	huawei	model:	huaweiwear	scope:	lte	version:	21.0.0.360	Trust: 1.0
vendor:	huawei	model:	hihealthapp	scope:	lte	version:	3.0.3.300	Trust: 1.0
vendor:	huawei	model:	pay	scope:	lte	version:	8.0.0.300	Trust: 1.0
vendor:	huawei	model:	crowdtest	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	hiapp	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	hicinema	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	hihealthapp	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	hiwallet	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	pay	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	huaweiwear	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	hwclouddrive	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	hwparentcontrol	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	hwparentcontrolparent	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	hwphonefinder	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	skytone	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	smarthome	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2017-010794 // NVD: CVE-2017-2704

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-2704
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-2704
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201711-1013
value:	HIGH
Trust: 0.6
VULHUB:	VHN-110907
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2017-2704
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-2704
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-110907
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-2704
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2017-2704
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-110907 // VULMON: CVE-2017-2704 // JVNDB: JVNDB-2017-010794 // CNNVD: CNNVD-201711-1013 // NVD: CVE-2017-2704

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-110907 // JVNDB: JVNDB-2017-010794 // NVD: CVE-2017-2704

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201711-1013

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201711-1013

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-010794

PATCH

title:	huawei-sa-20170920-01-encryption	url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-encryption-en	Trust: 0.8
title:	Multiple Huawei Product information disclosure vulnerability repair measures	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76723	Trust: 0.6

sources: JVNDB: JVNDB-2017-010794 // CNNVD: CNNVD-201711-1013

EXTERNAL IDS

db:	NVD	id:	CVE-2017-2704	Trust: 2.6
db:	JVNDB	id:	JVNDB-2017-010794	Trust: 0.8
db:	CNNVD	id:	CNNVD-201711-1013	Trust: 0.7
db:	VULHUB	id:	VHN-110907	Trust: 0.1
db:	VULMON	id:	CVE-2017-2704	Trust: 0.1

sources: VULHUB: VHN-110907 // VULMON: CVE-2017-2704 // JVNDB: JVNDB-2017-010794 // CNNVD: CNNVD-201711-1013 // NVD: CVE-2017-2704

REFERENCES

url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-encryption-en	Trust: 1.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2704	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-2704	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/200.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-110907 // VULMON: CVE-2017-2704 // JVNDB: JVNDB-2017-010794 // CNNVD: CNNVD-201711-1013 // NVD: CVE-2017-2704

SOURCES

db:	VULHUB	id:	VHN-110907
db:	VULMON	id:	CVE-2017-2704
db:	JVNDB	id:	JVNDB-2017-010794
db:	CNNVD	id:	CNNVD-201711-1013
db:	NVD	id:	CVE-2017-2704

LAST UPDATE DATE

2025-04-20T23:24:51.255000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-110907	date:	2020-04-02T00:00:00
db:	VULMON	id:	CVE-2017-2704	date:	2020-04-02T00:00:00
db:	JVNDB	id:	JVNDB-2017-010794	date:	2017-12-25T00:00:00
db:	CNNVD	id:	CNNVD-201711-1013	date:	2020-04-03T00:00:00
db:	NVD	id:	CVE-2017-2704	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-110907	date:	2017-11-22T00:00:00
db:	VULMON	id:	CVE-2017-2704	date:	2017-11-22T00:00:00
db:	JVNDB	id:	JVNDB-2017-010794	date:	2017-12-25T00:00:00
db:	CNNVD	id:	CNNVD-201711-1013	date:	2017-11-24T00:00:00
db:	NVD	id:	CVE-2017-2704	date:	2017-11-22T19:29:00.723