CVE-2017-2721

MEDIUM

Huawei Berlin/L21/L22/L23/L24/FRD Firmware - Factory Reset Protection Bypass via Swype Keyboard

Title source: llm
STIX 2.1

Description

Some Huawei smart phones with software Berlin-L21C10B130,Berlin-L21C185B133,Berlin-L21HNC10B131,Berlin-L21HNC185B140,Berlin-L21HNC432B151,Berlin-L22C636B160,Berlin-L22HNC636B130,Berlin-L22HNC675B150CUSTC675D001,Berlin-L23C605B131,Berlin-L24HNC567B110,FRD-L02C432B120,FRD-L02C635B130,FRD-L02C675B170CUSTC675D001,FRD-L04C567B162,FRD-L04C605B131,FRD-L09C10B130,FRD-L09C185B130,FRD-L09C432B131,FRD-L09C636B130,FRD-L14C567B162,FRD-L19C10B130,FRD-L19C432B131,FRD-L19C636B130 have a factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by Swype Keyboard and can perform some operations to update the Google account. As a result, the FRP function is bypassed.

References (1)

Core 1
Core References

Scores

CVSS v3 4.6
EPSS 0.0002
EPSS Percentile 6.0%
Attack Vector PHYSICAL
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-287
Status published
Products (24)
huawei/berlin-l21_firmware berlin-l21c10b130
huawei/berlin-l21_firmware berlin-l21c185b133
huawei/berlin-l21hn_firmware berlin-l21hnc10b131
huawei/berlin-l21hn_firmware berlin-l21hnc185b140
huawei/berlin-l21hn_firmware berlin-l21hnc432b151
huawei/berlin-l22_firmware berlin-l22c636b160
huawei/berlin-l22hn_firmware berlin-l22hnc636b130
huawei/berlin-l22hn_firmware berlin-l22hnc675b150custc675d001
huawei/berlin-l23_firmware berlin-l23c605b131
huawei/berlin-l24hn_firmware berlin-l24hnc567b110
... and 14 more
Published Nov 22, 2017
Tracked Since Feb 18, 2026