CVE-2017-2699 json
The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B12…
published 2017-11-22 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11842
- cvss
- 7.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of arbitrary code.
Patch / fix
- huawei honor_7_firmware plk-ul00c17b385
- huawei mate_s_firmware crr-l09c432b380
- huawei lyo-l21_firmware lyo-l21c577b128
Exploit prediction
0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- Huawei Technologies Co., Ltd. Honor 7, Mate S,LYO-L21
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
-
huawei.com
/en/psirt/security-advisories/huawei-sa-20170222-01-theme-en
vendor-advisory
-
securityfocus.com
/bid/96424
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-2699
- NVD CVE-2017-2699
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.