CVE-2017-2708 json
The 'Find Phone' function in Nice smartphones with software versions earlier before Nice-AL00C00B0135 has an authentication bypass vulnerab…
published 2017-11-22 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11851
- cvss
- 4.6
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
The 'Find Phone' function in Nice smartphones with software versions earlier before Nice-AL00C00B0135 has an authentication bypass vulnerability. An unauthenticated attacker may wipe and factory reset the phone by special steps. Due to missing authentication of the 'Find Phone' function, an attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally.
Patch / fix
- huawei nice_firmware nice-al00c00b0135
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 4.6 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.9 | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Affected products
- Huawei Technologies Co., Ltd. Nice
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
huawei.com
/en/psirt/security-advisories/huawei-sa-20170125-01-smartphone-en
issue-tracking, vendor-advisory
-
securityfocus.com
/bid/95911
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-2708
- NVD CVE-2017-2708
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.