What’s Vulnerable › Vulnerabilities

CVE-2017-15325

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-23 · updated 2026-06-17
• Weakness: CWE-190

Description

The Bdat driver of Prague smart phones with software versions earlier than Prague-AL00AC00B211, versions earlier than Prague-AL00BC00B211, versions earlier than Prague-AL00CC00B211, versions earlier than Prague-TL00AC01B211, versions earlier than Prague-TL10AC01B211 has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP and execute it as a specific privilege; the APP can then send a specific parameter to the driver of the smart phone, causing arbitrary code execution.

Affected products

• Huawei Prague-Al00A Firmware: before prague-al00ac00b211 — fixed in prague-al00ac00b211
• Huawei Prague-Al00B Firmware: before prague-al00bc00b211 — fixed in prague-al00bc00b211
• Huawei Prague-Al00C Firmware: before prague-al00cc00b211 — fixed in prague-al00cc00b211
• Huawei Prague-Tl00A Firmware: before prague-tl00ac01b211 — fixed in prague-tl00ac01b211
• Huawei Prague-Tl10A Firmware: before prague-tl10ac01b211 — fixed in prague-tl10ac01b211

How to fix

Upgrade to a fixed version: Huawei Prague-Al00A Firmware prague-al00ac00b211; Huawei Prague-Al00B Firmware prague-al00bc00b211; Huawei Prague-Al00C Firmware prague-al00cc00b211; Huawei Prague-Tl00A Firmware prague-tl00ac01b211; Huawei Prague-Tl10A Firmware prague-tl10ac01b211. Check the vendor advisory for mitigations.

References

• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180321-01-smartphone-en
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180321-01-smartphone-en

Get alerted when CVE-2017-15325 or the next vulnerability affects your stack