RCS module in Huawei ALP-AL00B smart phones with software versions earlier than…
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earlier than 8.0.0.129 has a remote control vulnerability. An attacker can trick a user to install a malicious application. When the application connects with RCS for the first time, it needs user to manually click to agree. In addition, the attacker needs to obtain the key that RCS uses to authenticate the application. Successful exploitation may cause the attacker to control keyboard remotely.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | ALP-AL00B, BLA-AL00B | ALP-AL00B, earlier versions than 8.0.0.129, BLA-AL00B, earlier versions than 8.0.0.129 | — | No fix listed | CNA |
- ALP-AL00B, BLA-AL00B VendorHuawei Affected ALP-AL00B, earlier versions than 8.0.0.129, BLA-AL00B, earlier versions than 8.0.0.129 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:alp-al00b_firmware:*:*:*:*:*:*:*:* | before 8.0.0.129 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:alp-al00b:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:bla-al00b_firmware:*:*:*:*:*:*:*:* | before 8.0.0.129 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:bla-al00b:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:alp-al00b_firmware:*:*:*:*:*:*:*:* Versions before 8.0.0.129 Vulnerable ·Huawei
- cpe:2.3:h:huawei:alp-al00b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:bla-al00b_firmware:*:*:*:*:*:*:*:* Versions before 8.0.0.129 Vulnerable ·Huawei
- cpe:2.3:h:huawei:bla-al00b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-7901
- 2026-10-03 Alias added: GHSA-3mh5-q9p2-6cqr
References
More Huawei Alp-al00b Firmware vulnerabilities
- TI-2019-01829 Use after free in Android KEVCVSS 3.1HIGH 7.8
- TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
- TI-2018-05725 Improper authentication in Huawei ALP-AL00B, ALP-TL00B, BLA-AL00B, BLA-L09C, BLA-L29C CVSS 3.0MEDIUM 6.8
- TI-2019-03669 NULL pointer dereference in Harry-AL00C, Harry-AL00C-PRELOAD, Harry-AL10B… CVSS 3.1MEDIUM 5.3
- TI-2019-03732 Improper input validation in Huawei ALP-AL00B CVSS 3.1MEDIUM 5.3
- TI-2019-03731 Improper input validation in Huawei Sydney-L21 CVSS 3.1MEDIUM 5.3
Sources
- CVE-2018-7901 · CVE Program
- CVE-2018-7901 · NVD
- FIRST EPSS
- GHSA-3mh5-q9p2-6cqr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences