CVE-2018-7956

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-04 · updated 2026-06-17

Description

Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions before 4.0.5 that attackers can conduct bruteforce to the VIP App Web Services to get user information.

Affected products

HUAWEI Mate 20: all versions
Huawei Nova 3 Firmware: all versions
Huawei Nova 3I Firmware: all versions
Huawei Vip App: before 4.0.5 — fixed in 4.0.5

How to fix

Upgrade to a fixed version: Huawei Vip App 4.0.5. Check the vendor advisory for mitigations.

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181129-01-huaweivip-en
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181129-01-huaweivip-en

Get alerted when CVE-2018-7956 or the next vulnerability affects your stack