Memory corruption in Huawei Honor 5A
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
The boot loaders in Honor 5A smart phones with software Versions earlier than CAM-TL00C01B193,Versions earlier than CAM-TL00HC00B193,Versions earlier than CAM-UL00C00B193 have a buffer overflow vulnerability. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer overflow in the next system reboot, causing continuous system reboot or arbitrary code execution.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | Honor 5A | Versions earlier than CAM-TL00C01B193,Versions earlier than CAM-TL00HC00B193,Versions earlier than CAM-UL00C00B193 | — | No fix listed | CNA |
- Honor 5A VendorHuawei Affected Versions earlier than CAM-TL00C01B193,Versions earlier than CAM-TL00HC00B193,Versions earlier than CAM-UL00C00B193 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* | before cam-tl00c01b193 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:honor_5a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* | before cam-tl00hc00b193; before cam-ul00c00b193 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:p8_lite_firmware:*:*:*:*:*:*:*:* | before ale-l02c635b568 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p8_lite:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:p8_lite_firmware:*:*:*:*:*:*:*:* | before ale-l21c10b541; before ale-l21c185b568; before ale-l21c432b596; before ale-l21c464b595; before ale-l21c636b568; before ale-l23c605b535 | Vulnerable | Huawei |
- cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* Versions before cam-tl00c01b193 Vulnerable ·Huawei
- cpe:2.3:h:huawei:honor_5a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:honor_5a_firmware:*:*:*:*:*:*:*:* Versions before cam-tl00hc00b193; before cam-ul00c00b193 Vulnerable ·Huawei
- cpe:2.3:o:huawei:p8_lite_firmware:*:*:*:*:*:*:*:* Versions before ale-l02c635b568 Vulnerable ·Huawei
- cpe:2.3:h:huawei:p8_lite:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:p8_lite_firmware:*:*:*:*:*:*:*:* Versions before ale-l21c10b541; before ale-l21c185b568; before ale-l21c432b596; before ale-l21c464b595; before ale-l21c636b568; before ale-l23c605b535 Vulnerable ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2729
- 2026-10-03 Alias added: GHSA-r36m-m8f3-qqfx
References
More Huawei Honor 5a Firmware vulnerabilities
- TI-2017-05719 Honor 5A,Honor 8 Lite,Mate9,Mate9 Pro,P10,P10 Plus Huawei smartphones with software the… CVSS 3.0MEDIUM 5.5
- TI-2018-05745 Huawei smart phones G9 Lite, Honor 5A, Honor 6X, Honor 8 with the versions before… CVSS 3.0MEDIUM 4.6
Sources
- CVE-2017-2729 · CVE Program
- CVE-2017-2729 · NVD
- FIRST EPSS
- GHSA-r36m-m8f3-qqfx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences