How severe is CVE-2017-8172?

CVE-2017-8172 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2017-8172 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-8172?

CVE-2017-8172 primarily affects Huawei P10 Plus Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-8172?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-8172 published?

CVE-2017-8172 was published on 2017-11-22 and last updated on 2026-06-17.

CVE-2017-8172

CVE-2017-8172 is a medium-severity vulnerability in Huawei P10 Plus Firmware with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-129.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 7.1
EPSS exploit prediction: 1% (46th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-129
Affected product: Huawei P10 Plus Firmware
Published: 2017-11-22
Last modified: 2026-06-17

Description

Isub service in P10 Plus and P10 smart phones with earlier than VKY-AL00C00B157 versions and earlier than VTR-AL00C00B157 versions has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application on the smart phone, and the application can send given parameter to specific interface, which make a out-of-bounds array access that results in smart phone restart.

Frequently asked questions

What is CVE-2017-8172?: Isub service in P10 Plus and P10 smart phones with earlier than VKY-AL00C00B157 versions and earlier than VTR-AL00C00B157 versions has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application on the smart phone, and the application can send given parameter to specific interface, which make a out-of-bounds array access that results in smart phone restart.
How severe is CVE-2017-8172?: CVE-2017-8172 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2017-8172 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-8172?: CVE-2017-8172 primarily affects Huawei P10 Plus Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-8172?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-8172 published?: CVE-2017-8172 was published on 2017-11-22 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:o:huawei:p10_plus_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:p10_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Huawei P10 Plus Firmware

CVE-2017-2726 — High (CVSS 8.4): Bastet in P10 Plus and P10 smart phones with software earlier than VKY-AL00C00B123 versions, earlier than…
CVE-2017-2724 — High (CVSS 8.4): Bastet in P10 Plus and P10 smart phones with software earlier than VKY-AL00C00B123 versions, earlier than…
CVE-2017-8150 — High (CVSS 7.8): The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the…
CVE-2017-8141 — High (CVSS 7.8): The Touch Panel (TP) driver in P10 Plus smart phones with software versions earlier than VKY-AL00C00B153 has a memory…
CVE-2017-2725 — High (CVSS 7.8): Bastet in P10 Plus and P10 smart phones with software earlier than VKY-AL00C00B123 versions, earlier than…
CVE-2017-8215 — Medium (CVSS 6.2): Honor 8,Honor V8,Honor 9,Honor V9,Nova 2,Nova 2 Plus,P9,P10 Plus,Toronto Huawei smart phones with software of versions…

All CVEs affecting Huawei P10 Plus Firmware →

Other CWE-129 (Improper Validation of Array Index) vulnerabilities

CVE-2020-27485 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2020-27483 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2026-21413 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545…
CVE-2025-27034 — Critical (CVSS 9.8): Memory corruption while selecting the PLMN from SOR failed list.
CVE-2025-3357 — Critical (CVSS 9.8): IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code…
CVE-2024-45569 — Critical (CVSS 9.8): Memory corruption while parsing the ML IE due to invalid frame content.

Browse all CWE-129 (Improper Validation of Array Index) vulnerabilities →