What’s Vulnerable › Vulnerabilities

CVE-2017-8202

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-22 · updated 2026-06-17
• Weakness: CWE-119

Description

The CameraISP driver of some Huawei smart phones with software of versions earlier than Prague-AL00AC00B205,versions earlier than Prague-AL00BC00B205,versions earlier than Prague-AL00CC00B205,versions earlier than Prague-TL00AC01B205,versions earlier than Prague-TL10AC01B205 has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP, the APP can send a specific parameter to the CameraISP driver of the smart phone, causing system reboot.

Affected products

• Huawei Prague-Al00A Firmware: before prague-al00ac00b205 — fixed in prague-al00ac00b205
• Huawei Prague-Al00B Firmware: before prague-al00bc00b205 — fixed in prague-al00bc00b205
• Huawei Prague-Al00C Firmware: before prague-al00cc00b205 — fixed in prague-al00cc00b205
• Huawei Prague-Tl00A Firmware: before prague-tl00ac01b205 — fixed in prague-tl00ac01b205
• Huawei Prague-Tl10A Firmware: before prague-tl10ac01b205 — fixed in prague-tl10ac01b205

How to fix

Upgrade to a fixed version: Huawei Prague-Al00A Firmware prague-al00ac00b205; Huawei Prague-Al00B Firmware prague-al00bc00b205; Huawei Prague-Al00C Firmware prague-al00cc00b205; Huawei Prague-Tl00A Firmware prague-tl00ac01b205; Huawei Prague-Tl10A Firmware prague-tl10ac01b205. Check the vendor advisory for mitigations.

References

• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171115-01-smartphone-en
• http://www.securityfocus.com/bid/101959
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171115-01-smartphone-en
• http://www.securityfocus.com/bid/101959

Get alerted when CVE-2017-8202 or the next vulnerability affects your stack