How severe is CVE-2017-17326?

CVE-2017-17326 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2017-17326 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-17326?

CVE-2017-17326 primarily affects Huawei Mate 9 Pro Fimware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-17326?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-17326 published?

CVE-2017-17326 was published on 2018-03-09 and last updated on 2026-06-17.

CVE-2017-17326

CVE-2017-17326 is a medium-severity vulnerability in Huawei Mate 9 Pro Fimware with a CVSS 3.x base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 4.6)
CVSS v2: 2.1
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Huawei Mate 9 Pro Fimware
Published: 2018-03-09
Last modified: 2026-06-17

Description

Huawei Mate 9 Pro Smartphones with software of LON-AL00BC00B139D; LON-AL00BC00B229 have an activation lock bypass vulnerability. The smartphone is supposed to be activated by the former account after reset if find my phone function is on. The software does not have a sufficient protection of activation lock. Successful exploit could allow an attacker to bypass the activation lock and activate the smartphone by a new account after a series of operation.

Frequently asked questions

What is CVE-2017-17326?: Huawei Mate 9 Pro Smartphones with software of LON-AL00BC00B139D; LON-AL00BC00B229 have an activation lock bypass vulnerability. The smartphone is supposed to be activated by the former account after reset if find my phone function is on. The software does not have a sufficient protection of activation lock. Successful exploit could allow an attacker to bypass the activation lock and activate the smartphone by a new account after a series of operation.
How severe is CVE-2017-17326?: CVE-2017-17326 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2017-17326 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-17326?: CVE-2017-17326 primarily affects Huawei Mate 9 Pro Fimware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-17326?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-17326 published?: CVE-2017-17326 was published on 2018-03-09 and last updated on 2026-06-17.

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171227-01-smartphone-en

Affected products (2)

cpe:2.3:o:huawei:mate_9_pro_fimware:lon-al00bc00b139d:*:*:*:*:*:*:*
cpe:2.3:o:huawei:mate_9_pro_fimware:lon-al00bc00b229:*:*:*:*:*:*:*

More vulnerabilities in Huawei Mate 9 Pro Fimware

CVE-2017-17173 — High (CVSS 7.8): Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before…
CVE-2019-5244 — Medium (CVSS 5.5): Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due…

All CVEs affecting Huawei Mate 9 Pro Fimware →