CVE-2018-7928

Severity: medium (CVSS 4.6 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-09 · updated 2026-06-17

Description

There is a security vulnerability which could lead to Factory Reset Protection (FRP) bypass in the MyCloud APP with the versions before 8.1.2.303 installed on some Huawei smart phones. When re-configuring the mobile phone using the FRP function, an attacker can replace the old account with a new one through special steps by exploit this vulnerability. As a result, the FRP function is bypassed.

Affected products

Huawei Technologies Co., Ltd. MyCloud: before 8.1.2.303 — fixed in 8.1.2.303

How to fix

Upgrade to a fixed version: Huawei Technologies Co., Ltd. MyCloud 8.1.2.303. Check the vendor advisory for mitigations.

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180930-01-mycloud-en
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180930-01-mycloud-en

Get alerted when CVE-2018-7928 or the next vulnerability affects your stack