Memory corruption in Huawei P10, P10 Plus
Priority LOW 36CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the versions before Victoria-L29AC605B162, the versions before Vicky-L29AC605B162 have an arbitrary memory write vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause arbitrary memory writing in the next system reboot, causing continuous system reboot or arbitrary code execution.
Why it matters now
EPSS 0.00958 61st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | P10, P10 Plus | The versions before Victoria-L09AC605B162, The versions before Victoria-L29AC605B162, The versions before Vicky-L29AC605B162 | — | No fix listed | CNA |
- P10, P10 Plus VendorHuawei Affected The versions before Victoria-L09AC605B162, The versions before Victoria-L29AC605B162, The versions before Vicky-L29AC605B162 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:p10_firmware:*:*:*:*:*:*:*:* | before victoria-l09ac605b162 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:p10_firmware:*:*:*:*:*:*:*:* | before victoria-l29ac605b162 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:p10_plus_firmware:*:*:*:*:*:*:*:* | before vicky-l29ac605b162 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p10_plus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:p8_lite_firmware:*:*:*:*:*:*:*:* | before ale-l21c113b566 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p8_lite:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:p9_firmware:*:*:*:*:*:*:*:* | before eva-l09c432b391 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p9:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:p9_firmware:*:*:*:*:*:*:*:* | before eva-l09c576b386; before eva-l09c605b390; before eva-l09c635b387; before eva-l09c636b388; before eva-l19c10b390; before eva-l19c432b388; before eva-l19c605b390; before eva-l19c636b391 | Vulnerable | Huawei |
- cpe:2.3:o:huawei:p10_firmware:*:*:*:*:*:*:*:* Versions before victoria-l09ac605b162 Vulnerable ·Huawei
- cpe:2.3:h:huawei:p10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:p10_firmware:*:*:*:*:*:*:*:* Versions before victoria-l29ac605b162 Vulnerable ·Huawei
- cpe:2.3:o:huawei:p10_plus_firmware:*:*:*:*:*:*:*:* Versions before vicky-l29ac605b162 Vulnerable ·Huawei
- cpe:2.3:h:huawei:p10_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:p8_lite_firmware:*:*:*:*:*:*:*:* Versions before ale-l21c113b566 Vulnerable ·Huawei
- cpe:2.3:h:huawei:p8_lite:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:p9_firmware:*:*:*:*:*:*:*:* Versions before eva-l09c432b391 Vulnerable ·Huawei
- cpe:2.3:h:huawei:p9:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:p9_firmware:*:*:*:*:*:*:*:* Versions before eva-l09c576b386; before eva-l09c605b390; before eva-l09c635b387; before eva-l09c636b388; before eva-l19c10b390; before eva-l19c432b388; before eva-l19c605b390; before eva-l19c636b391 Vulnerable ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-8150
- 2026-10-03 Alias added: GHSA-qhww-87f6-pq58
References
More Huawei P10 Firmware vulnerabilities
- TI-2017-01968 Memory corruption in Huawei P10 Plus,P10 CVSS 3.0HIGH 8.4
- TI-2017-01966 Memory corruption in Huawei P10 Plus,P10 CVSS 3.0HIGH 8.4
- TI-2017-01967 Memory corruption in Huawei P10 Plus,P10 CVSS 3.0HIGH 7.8
- TI-2017-05747 Improper array index validation in Huawei P10 Plus,P10 CVSS 3.0MEDIUM 5.5
- TI-2017-05721 Improper input validation in Huawei P10, P10 Plus CVSS 3.0MEDIUM 5.5
- TI-2017-05720 Improper input validation in Huawei P10, P10 Plus CVSS 3.0MEDIUM 5.5
Sources
- CVE-2017-8150 · CVE Program
- CVE-2017-8150 · NVD
- FIRST EPSS
- GHSA-qhww-87f6-pq58 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences