How severe is CVE-2017-17176?

CVE-2017-17176 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2017-17176 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-17176?

CVE-2017-17176 primarily affects Huawei Mate 9 Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-17176?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-17176 published?

CVE-2017-17176 was published on 2018-10-17 and last updated on 2026-06-17.

CVE-2017-17176

CVE-2017-17176 is a medium-severity vulnerability in Huawei Mate 9 Firmware with a CVSS 3.x base score of 6.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-787.

Key facts

Severity: Medium (CVSS 3.x base score 6.7)
CVSS v2: 7.2
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-787
Affected product: Huawei Mate 9 Firmware
Published: 2018-10-17
Last modified: 2026-06-17

Description

The hardware security module of Mate 9 and Mate 9 Pro Huawei smart phones with the versions earlier before MHA-AL00BC00B156, versions earlier before MHA-CL00BC00B156, versions earlier before MHA-DL00BC00B156, versions earlier before MHA-TL00BC00B156, versions earlier before LON-AL00BC00B156, versions earlier before LON-CL00BC00B156, versions earlier before LON-DL00BC00B156, versions earlier before LON-TL00BC00B156 has a arbitrary memory read/write vulnerability due to the input parameters validation. An attacker with the root privilege of the Android system could exploit this vulnerability to read and write memory data anywhere or execute arbitrary code in the TrustZone.

Frequently asked questions

What is CVE-2017-17176?: The hardware security module of Mate 9 and Mate 9 Pro Huawei smart phones with the versions earlier before MHA-AL00BC00B156, versions earlier before MHA-CL00BC00B156, versions earlier before MHA-DL00BC00B156, versions earlier before MHA-TL00BC00B156, versions earlier before LON-AL00BC00B156, versions earlier before LON-CL00BC00B156, versions earlier before LON-DL00BC00B156, versions earlier before LON-TL00BC00B156 has a arbitrary memory read/write vulnerability due to the input parameters validation. An attacker with the root privilege of the Android system could exploit this vulnerability to read and write memory data anywhere or execute arbitrary code in the TrustZone.
How severe is CVE-2017-17176?: CVE-2017-17176 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-17176 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-17176?: CVE-2017-17176 primarily affects Huawei Mate 9 Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-17176?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-17176 published?: CVE-2017-17176 was published on 2018-10-17 and last updated on 2026-06-17.

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170306-01-smartphone-en

Affected products (2)

cpe:2.3:o:huawei:mate_9_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:mate_9_pro_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Huawei Mate 9 Firmware

CVE-2017-15311 — High (CVSS 8.8): The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00…
CVE-2017-15316 — High (CVSS 7.8): The GPU driver of Mate 9 Huawei smart phones with software before MHA-AL00B 8.0.0.334(C00) and Mate 9 Pro Huawei smart…
CVE-2017-8142 — High (CVSS 7.8): The Trusted Execution Environment (TEE) module driver of Mate 9 and Mate 9 Pro smart phones with software versions…
CVE-2017-2716 — High (CVSS 7.8): The camerafs driver in Mate 9 Versions earlier than MHA-AL00BC00B173 has buffer overflow vulnerability. An attacker…
CVE-2017-2707 — High (CVSS 7.1): Mate 9 smartphones with software MHA-AL00AC00B125 have a privilege escalation vulnerability in Push module. An attacker…
CVE-2017-2706 — High (CVSS 7.1): Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in Push module. Since the…

All CVEs affecting Huawei Mate 9 Firmware →

Other CWE-787 (Out-of-bounds Write) vulnerabilities

CVE-2026-42369 — Critical (CVSS 10.0): GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other…
CVE-2026-4746 — Critical (CVSS 10.0): Out-of-bounds Write vulnerability in timeplus-io proton (base/poco/Foundation/src‎ modules). This vulnerability is…
CVE-2025-43300 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS…
CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
CVE-2024-42479 — Critical (CVSS 10.0): llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause…
CVE-2024-39791 — Critical (CVSS 10.0): Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge…

Browse all CWE-787 (Out-of-bounds Write) vulnerabilities →