Skip to content
Fencer Intel
high 8.8

CVE-2017-15311 json

The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), befor…

published 2017-12-22 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-6767

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120(SP2C00), before MHA-AL00B 8.0.0.334(C00), and before LON-AL00B 8.0.0.334(C00) have a stack overflow vulnerability due to the lack of parameter validation. An attacker could send malicious packets to the smart phones within radio range by special wireless device, which leads stack overflow when the baseband module handles these packets. The attacker could exploit this vulnerability to perform a denial of service attack or remote code execution in baseband module.

Patch / fix

  • huawei mate_10_firmware alp-al00_8.0.0.120\(sp2c00\)
  • huawei mate_10_pro_firmware bla-al00_8.0.0.120\(sp2c00\)
  • huawei mate_9_firmware mha-al00b_8.0.0.334\(c00\)
  • huawei mate_9_pro_firmware lon-al00b_8.0.0.334\(c00\)

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 5.8 AV:A/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Huawei Technologies Co., Ltd. Mate 10
  • Huawei Technologies Co., Ltd. Mate 10 Pro
  • Huawei Technologies Co., Ltd. Mate 9
  • Huawei Technologies Co., Ltd. Mate 9 Pro

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.