CVE-2017-15322

Some Huawei smartphones with software of BGO-L03C158B003CUSTC158D001 and BGO-L03C331B009CUSTC331D001 have a DoS vulnerability due to insufficient input validation. An attacker could exploit this vulnerability by sending specially crafted NFC messages to the target device. Successful exploit could make a service crash.

CVSS v3 6.5 MEDIUM
CVSS v2.0 3.3 LOW

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 6.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-01-nfc-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:huawei:baggio-l03a_firmware:bgo-l03c158b003custc158d001:::::::*
	cpe:2.3:o:huawei:baggio-l03a_firmware:bgo-l03c331b009custc331d001:::::::*

cpe:2.3:h:huawei:baggio-l03a:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-12-22 17:29

Updated : 2024-02-04 19:29

NVD link : CVE-2017-15322

Mitre link : CVE-2017-15322

CVE.ORG link : CVE-2017-15322

JSON object : View

Products Affected

huawei

baggio-l03a_firmware
baggio-l03a

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2017-15322", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2017-12-22T17:29:13.423", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-01-nfc-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Some Huawei smartphones with software of BGO-L03C158B003CUSTC158D001 and BGO-L03C331B009CUSTC331D001 have a DoS vulnerability due to insufficient input validation. An attacker could exploit this vulnerability by sending specially crafted NFC messages to the target device. Successful exploit could make a service crash."}, {"lang": "es", "value": "Algunos smartphones Huawei con software de BGO-L03C158B003CUSTC158D001 y BGO-L03C331B009CUSTC331D001 contienen una vulnerabilidad de DoS debida a una validaci\u00f3n de entradas insuficiente. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de mensajes NFC especialmente manipulados al dispositivo objetivo. Una explotaci\u00f3n exitosa podr\u00eda provocar el cierre inesperado de un servicio."}], "lastModified": "2018-01-09T16:02:53.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:baggio-l03a_firmware:bgo-l03c158b003custc158d001:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EDD8D84-1203-44E2-A1EC-57B9DB028A7D"}, {"criteria": "cpe:2.3:o:huawei:baggio-l03a_firmware:bgo-l03c331b009custc331d001:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D95F753B-C655-41E2-8A2A-3C9BA919EA2D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:baggio-l03a:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DCC40DA7-38EB-4A2D-A569-8FF48D84ACF1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}