CVE-2018-7988

Severity: medium (CVSS 4.6 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-27 · updated 2026-06-17
Weakness: CWE-863

Description

There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to another smartphone and then perform a series of specific operations. Successful exploit could allow the attacker bypass the FRP protection.

Affected products

Huawei Technologies Co., Ltd. Mate 9 Pro: before 8.0.0.363\(c00\) — fixed in 8.0.0.363\(c00\)
Huawei Nova 2 Plus Firmware: before 8.0.0.350\(c00\) — fixed in 8.0.0.350\(c00\)

How to fix

Upgrade to a fixed version: Huawei Technologies Co., Ltd. Mate 9 Pro 8.0.0.363\(c00\); Huawei Nova 2 Plus Firmware 8.0.0.350\(c00\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-7988 or the next vulnerability affects your stack