CVE-2017-8173

Severity: medium (CVSS 4.6 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-22 · updated 2026-06-17

Description

Maya-L02,VKY-L09,VTR-L29,Vicky-AL00A,Victoria-AL00A,Warsaw-AL00 smart phones with software of earlier than Maya-L02C636B126 versions,earlier than VKY-L29C10B151 versions,earlier than VTR-L29C10B151 versions,earlier than Vicky-AL00AC00B162 versions,earlier than Victoria-AL00AC00B167 versions,earlier than Warsaw-AL00C00B200 versions have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by some secret code and can perform some operations to update the Google account. As a result, the FRP function is bypassed.

Affected products

Huawei Maya-L02 Firmware: before maya-l02c636b126 — fixed in maya-l02c636b126
Huawei Technologies Co., Ltd. Vicky-AL00A: before vicky-al00ac00b162 — fixed in vicky-al00ac00b162
Huawei Victoria-Al00A Firmware: before victoria-al00ac00b167 — fixed in victoria-al00ac00b167
Huawei Vky-L09 Firmware: before vky-l29c10b151 — fixed in vky-l29c10b151
Huawei Vky-L29 Firmware: before vtr-l29c10b151 — fixed in vtr-l29c10b151
Huawei Warsaw-Al00 Firmware: before warsaw-al00c00b200 — fixed in warsaw-al00c00b200

How to fix

Upgrade to a fixed version: Huawei Maya-L02 Firmware maya-l02c636b126; Huawei Technologies Co., Ltd. Vicky-AL00A vicky-al00ac00b162; Huawei Victoria-Al00A Firmware victoria-al00ac00b167; Huawei Vky-L09 Firmware vky-l29c10b151; Huawei Vky-L29 Firmware vtr-l29c10b151; Huawei Warsaw-Al00 Firmware warsaw-al00c00b200. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-8173 or the next vulnerability affects your stack