Improper authentication in Huawei…
Priority LOW 21CWE-287Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
Some Huawei smart phones with software Berlin-L21C10B130,Berlin-L21C185B133,Berlin-L21HNC10B131,Berlin-L21HNC185B140,Berlin-L21HNC432B151,Berlin-L22C636B160,Berlin-L22HNC636B130,Berlin-L22HNC675B150CUSTC675D001,Berlin-L23C605B131,Berlin-L24HNC567B110,FRD-L02C432B120,FRD-L02C635B130,FRD-L02C675B170CUSTC675D001,FRD-L04C567B162,FRD-L04C605B131,FRD-L09C10B130,FRD-L09C185B130,FRD-L09C432B131,FRD-L09C636B130,FRD-L14C567B162,FRD-L19C10B130,FRD-L19C432B131,FRD-L19C636B130 have a factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by Swype Keyboard and can perform some operations to update the Google account. As a result, the FRP function is bypassed.
Why it matters now
EPSS 0.00197 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | Berlin-L21,Berlin-L21HN,Berlin-L22,Berlin-L22HN,Berlin-L23,Berlin-L24HN,FRD-L02,FRD-L04,FRD-L09,FRD-L14,FRD-L19, | Berlin-L21C10B130,Berlin-L21C185B133,Berlin-L21HNC10B131,Berlin-L21HNC185B140,Berlin-L21HNC432B151,Berlin-L22C636B160,Berlin-L22HNC636B130,Berlin-L22HNC675B150CUSTC675D001,Berlin-L23C605B131,Berlin-L24HNC567B110,FRD-L02C432B120,FRD-L02C635B130,FRD-L02C675B170CUSTC675D001,FRD-L04C567B162,FRD-L04C605B131,FRD-L09C10B130,FRD-L09C185B130,FRD-L09C432B131,FRD-L09C636B130,FRD-L14C567B162,FRD-L19C10B130,FRD-L19C432B131,FRD-L19C636B130, | — | No fix listed | CNA |
- Berlin-L21,Berlin-L21HN,Berlin-L22,Berlin-L22HN,Berlin-L23,Berlin-L24HN,FRD-L02,FRD-L04,FRD-L09,FRD-L14,FRD-L19, VendorHuawei Affected Berlin-L21C10B130,Berlin-L21C185B133,Berlin-L21HNC10B131,Berlin-L21HNC185B140,Berlin-L21HNC432B151,Berlin-L22C636B160,Berlin-L22HNC636B130,Berlin-L22HNC675B150CUSTC675D001,Berlin-L23C605B131,Berlin-L24HNC567B110,FRD-L02C432B120,FRD-L02C635B130,FRD-L02C675B170CUSTC675D001,FRD-L04C567B162,FRD-L04C605B131,FRD-L09C10B130,FRD-L09C185B130,FRD-L09C432B131,FRD-L09C636B130,FRD-L14C567B162,FRD-L19C10B130,FRD-L19C432B131,FRD-L19C636B130, Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:berlin-l21_firmware:berlin-l21c10b130:*:*:*:*:*:*:* | berlin-l21c10b130 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:berlin-l21_firmware:berlin-l21c185b133:*:*:*:*:*:*:* | berlin-l21c185b133 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:berlin-l21:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:berlin-l21hn_firmware:berlin-l21hnc10b131:*:*:*:*:*:*:* | berlin-l21hnc10b131 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:berlin-l21hn_firmware:berlin-l21hnc185b140:*:*:*:*:*:*:* | berlin-l21hnc185b140 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:berlin-l21hn_firmware:berlin-l21hnc432b151:*:*:*:*:*:*:* | berlin-l21hnc432b151 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:berlin-l21hn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:berlin-l22_firmware:berlin-l22c636b160:*:*:*:*:*:*:* | berlin-l22c636b160 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:berlin-l22:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:berlin-l22hn_firmware:berlin-l22hnc636b130:*:*:*:*:*:*:* | berlin-l22hnc636b130 | Vulnerable | Huawei |
- cpe:2.3:o:huawei:berlin-l21_firmware:berlin-l21c10b130:*:*:*:*:*:*:* Versions berlin-l21c10b130 Vulnerable ·Huawei
- cpe:2.3:o:huawei:berlin-l21_firmware:berlin-l21c185b133:*:*:*:*:*:*:* Versions berlin-l21c185b133 Vulnerable ·Huawei
- cpe:2.3:h:huawei:berlin-l21:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:berlin-l21hn_firmware:berlin-l21hnc10b131:*:*:*:*:*:*:* Versions berlin-l21hnc10b131 Vulnerable ·Huawei
- cpe:2.3:o:huawei:berlin-l21hn_firmware:berlin-l21hnc185b140:*:*:*:*:*:*:* Versions berlin-l21hnc185b140 Vulnerable ·Huawei
- cpe:2.3:o:huawei:berlin-l21hn_firmware:berlin-l21hnc432b151:*:*:*:*:*:*:* Versions berlin-l21hnc432b151 Vulnerable ·Huawei
- cpe:2.3:h:huawei:berlin-l21hn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:berlin-l22_firmware:berlin-l22c636b160:*:*:*:*:*:*:* Versions berlin-l22c636b160 Vulnerable ·Huawei
- cpe:2.3:h:huawei:berlin-l22:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:berlin-l22hn_firmware:berlin-l22hnc636b130:*:*:*:*:*:*:* Versions berlin-l22hnc636b130 Vulnerable ·Huawei
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:berlin-l22hn_firmware:berlin-l22hnc675b150custc675d001:*:*:*:*:*:*:* | berlin-l22hnc675b150custc675d001 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:berlin-l22hn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:berlin-l23_firmware:berlin-l23c605b131:*:*:*:*:*:*:* | berlin-l23c605b131 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:berlin-l23:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:berlin-l24hn_firmware:berlin-l24hnc567b110:*:*:*:*:*:*:* | berlin-l24hnc567b110 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:berlin-l24hn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:frd-l02_firmware:frd-l02c432b120:*:*:*:*:*:*:* | frd-l02c432b120 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:frd-l02_firmware:frd-l02c635b130:*:*:*:*:*:*:* | frd-l02c635b130 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:frd-l02_firmware:frd-l02c675b170custc675d001:*:*:*:*:*:*:* | frd-l02c675b170custc675d001 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:frd-l02:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:frd-l04_firmware:frd-l04c567b162:*:*:*:*:*:*:* | frd-l04c567b162 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:frd-l04_firmware:frd-l04c605b131:*:*:*:*:*:*:* | frd-l04c605b131 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:frd-l04:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:frd-l09_firmware:frd-l09c10b130:*:*:*:*:*:*:* | frd-l09c10b130 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:frd-l09_firmware:frd-l09c185b130:*:*:*:*:*:*:* | frd-l09c185b130 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:frd-l09_firmware:frd-l09c432b131:*:*:*:*:*:*:* | frd-l09c432b131 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:frd-l09_firmware:frd-l09c636b130:*:*:*:*:*:*:* | frd-l09c636b130 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:frd-l09:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:frd-l14_firmware:frd-l14c567b162:*:*:*:*:*:*:* | frd-l14c567b162 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:frd-l14:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:frd-l19_firmware:frd-l19c10b130:*:*:*:*:*:*:* | frd-l19c10b130 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:frd-l19_firmware:frd-l19c432b131:*:*:*:*:*:*:* | frd-l19c432b131 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:frd-l19_firmware:frd-l19c636b130:*:*:*:*:*:*:* | frd-l19c636b130 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:frd-l19:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:berlin-l22hn_firmware:berlin-l22hnc675b150custc675d001:*:*:*:*:*:*:* Versions berlin-l22hnc675b150custc675d001 Vulnerable ·Huawei
- cpe:2.3:h:huawei:berlin-l22hn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:berlin-l23_firmware:berlin-l23c605b131:*:*:*:*:*:*:* Versions berlin-l23c605b131 Vulnerable ·Huawei
- cpe:2.3:h:huawei:berlin-l23:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:berlin-l24hn_firmware:berlin-l24hnc567b110:*:*:*:*:*:*:* Versions berlin-l24hnc567b110 Vulnerable ·Huawei
- cpe:2.3:h:huawei:berlin-l24hn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:frd-l02_firmware:frd-l02c432b120:*:*:*:*:*:*:* Versions frd-l02c432b120 Vulnerable ·Huawei
- cpe:2.3:o:huawei:frd-l02_firmware:frd-l02c635b130:*:*:*:*:*:*:* Versions frd-l02c635b130 Vulnerable ·Huawei
- cpe:2.3:o:huawei:frd-l02_firmware:frd-l02c675b170custc675d001:*:*:*:*:*:*:* Versions frd-l02c675b170custc675d001 Vulnerable ·Huawei
- cpe:2.3:h:huawei:frd-l02:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:frd-l04_firmware:frd-l04c567b162:*:*:*:*:*:*:* Versions frd-l04c567b162 Vulnerable ·Huawei
- cpe:2.3:o:huawei:frd-l04_firmware:frd-l04c605b131:*:*:*:*:*:*:* Versions frd-l04c605b131 Vulnerable ·Huawei
- cpe:2.3:h:huawei:frd-l04:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:frd-l09_firmware:frd-l09c10b130:*:*:*:*:*:*:* Versions frd-l09c10b130 Vulnerable ·Huawei
- cpe:2.3:o:huawei:frd-l09_firmware:frd-l09c185b130:*:*:*:*:*:*:* Versions frd-l09c185b130 Vulnerable ·Huawei
- cpe:2.3:o:huawei:frd-l09_firmware:frd-l09c432b131:*:*:*:*:*:*:* Versions frd-l09c432b131 Vulnerable ·Huawei
- cpe:2.3:o:huawei:frd-l09_firmware:frd-l09c636b130:*:*:*:*:*:*:* Versions frd-l09c636b130 Vulnerable ·Huawei
- cpe:2.3:h:huawei:frd-l09:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:frd-l14_firmware:frd-l14c567b162:*:*:*:*:*:*:* Versions frd-l14c567b162 Vulnerable ·Huawei
- cpe:2.3:h:huawei:frd-l14:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:frd-l19_firmware:frd-l19c10b130:*:*:*:*:*:*:* Versions frd-l19c10b130 Vulnerable ·Huawei
- cpe:2.3:o:huawei:frd-l19_firmware:frd-l19c432b131:*:*:*:*:*:*:* Versions frd-l19c432b131 Vulnerable ·Huawei
- cpe:2.3:o:huawei:frd-l19_firmware:frd-l19c636b130:*:*:*:*:*:*:* Versions frd-l19c636b130 Vulnerable ·Huawei
- cpe:2.3:h:huawei:frd-l19:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2721
- 2026-10-03 Alias added: GHSA-26ch-2fxx-xjff
References
More Huawei Berlin-l21 Firmware vulnerabilities
- TI-2017-12629 Improper input validation in Huawei… CVSS 3.0MEDIUM 5.5
Sources
- CVE-2017-2721 · CVE Program
- CVE-2017-2721 · NVD
- FIRST EPSS
- GHSA-26ch-2fxx-xjff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences