Skip to content
Fencer Vulns
medium 4.4

CVE-2018-7901 json

RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions ea…

published 2018-04-30 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-19613

cvss
4.4
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earlier than 8.0.0.129 has a remote control vulnerability. An attacker can trick a user to install a malicious application. When the application connects with RCS for the first time, it needs user to manually click to agree. In addition, the attacker needs to obtain the key that RCS uses to authenticate the application. Successful exploitation may cause the attacker to control keyboard remotely.

Patch / fix

  • huawei alp-al00b_firmware 8.0.0.129
  • huawei bla-al00b_firmware 8.0.0.129

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P

Affected products

  • Huawei Technologies Co., Ltd. ALP-AL00B, BLA-AL00B

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.