Incorrect permission assignment in Huawei Anne-AL00
Priority LOW 12CWE-732Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability. Due to improper permission settings for specific commands, attackers who can connect to a mobile phone via the USB interface may exploit this vulnerability to obtain specific device information of the mobile phone.
Why it matters now
EPSS 0.0023 13th percentileScored 2026-11-07
Fix Fixed Anne-AL00 (Huawei Technologies Co., Ltd.): 8.0.0.151(C00)
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | Anne-AL00 | before 8.0.0.151(C00) | 8.0.0.151(C00) | Patch available | CNA |
- Anne-AL00 VendorHuawei Affected before 8.0.0.151(C00) Fixed in 8.0.0.151(C00) Patch available CNA
Remediation
- Fix · CNA Anne-AL00 (Huawei Technologies Co., Ltd.) Fixed in 8.0.0.151(C00)
Timeline
- 2026-10-02 Threatist record created from CVE-2018-7924
- 2026-10-03 Alias added: GHSA-f2wv-jxwv-hgfp
References
More Huawei Anne-al00 Firmware vulnerabilities
- TI-2019-01829 Use after free in Android KEVCVSS 3.1HIGH 7.8
- TI-2020-07282 There is an information leakage vulnerability in some Huawei products. CVSS 3.1MEDIUM 6.5
- TI-2019-14002 Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. CVSS 3.1MEDIUM 4.6
Sources
- CVE-2018-7924 · CVE Program
- CVE-2018-7924 · NVD
- FIRST EPSS
- GHSA-f2wv-jxwv-hgfp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences