CVE-2017-8173 json
Maya-L02,VKY-L09,VTR-L29,Vicky-AL00A,Victoria-AL00A,Warsaw-AL00 smart phones with software of earlier than Maya-L02C636B126 versions,earlie…
published 2017-11-22 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-17135
- cvss
- 4.6
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
Maya-L02,VKY-L09,VTR-L29,Vicky-AL00A,Victoria-AL00A,Warsaw-AL00 smart phones with software of earlier than Maya-L02C636B126 versions,earlier than VKY-L29C10B151 versions,earlier than VTR-L29C10B151 versions,earlier than Vicky-AL00AC00B162 versions,earlier than Victoria-AL00AC00B167 versions,earlier than Warsaw-AL00C00B200 versions have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by some secret code and can perform some operations to update the Google account. As a result, the FRP function is bypassed.
Patch / fix
- huawei maya-l02_firmware maya-l02c636b126
- huawei vky-l09_firmware vky-l29c10b151
- huawei vky-l29_firmware vtr-l29c10b151
- huawei vicky-al00a_firmware vicky-al00ac00b162
- huawei victoria-al00a_firmware victoria-al00ac00b167
- huawei warsaw-al00_firmware warsaw-al00c00b200
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 4.6 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:N/I:P/A:N |
Affected products
- Huawei Technologies Co., Ltd. Maya-L02,VKY-L09,VTR-L29,Vicky-AL00A,Victoria-AL00A,Warsaw-AL00
References
-
huawei.com
/en/psirt/security-advisories/huawei-sa-20170715-01-frpbypass-en
issue-tracking, vendor-advisory
Sources
- CVE List CVE-2017-8173
- NVD CVE-2017-8173
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.