CVE-2017-2704

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-22 · updated 2026-06-17
Weakness: CWE-200

Description

Smarthome 1.0.2.364 and earlier versions,HiAPP 7.3.0.303 and earlier versions,HwParentControl 2.0.0 and earlier versions,HwParentControlParent 5.1.0.12 and earlier versions,Crowdtest 1.5.3 and earlier versions,HiWallet 8.0.0.301 and earlier versions,Huawei Pay 8.0.0.300 and earlier versions,Skytone 8.1.2.300 and earlier versions,HwCloudDrive(EMUI6.0) 8.0.0.307 and earlier versions,HwPhoneFinder(EMUI6.0) 9.3.0.310 and earlier versions,HwPhoneFinder(EMUI5.1) 9.2.2.303 and earlier versions,HiCinema 8.0.2.300 and earlier versions,HuaweiWear 21.0.0.360 and earlier versions,HiHealthApp 3.0.3.300 and earlier versions have an information exposure vulnerability. Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys, causing information exposure.

Affected products

Huawei Crowdtest: through 1.5.3
Huawei Hiapp: through 7.3.0.303
Huawei Technologies Co., Ltd. HiCinema: through 8.0.2.300
Huawei Hihealthapp: through 3.0.3.300
Huawei Technologies Co., Ltd. HiWallet: through 8.0.0.301
Huawei Pay: through 8.0.0.300
Huaweiwear: through 21.0.0.360
Huawei Hwclouddrive(Emui6.0): through 8.0.0.307
Huawei Hwparentcontrol: through 2.0.0
Huawei Hwparentcontrolparent: through 5.1.0.12
Huawei Hwphonefinder(Emui5.1): through 9.2.2.303
Huawei Hwphonefinder(Emui6.0): through 9.3.0.310
Huawei Skytone: through 8.1.2.300
Huawei Smarthome: through 1.0.2.364

References

Get alerted when CVE-2017-2704 or the next vulnerability affects your stack