CVE-2017-2730
HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for...
CVE-2017-2730 is a low vulnerability (CVSS 3.5) in Huawei Hilink, published October 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. No source names a fixed version.
- Severity
- 3.5 LowCVSS 3.0, NVD
- Exploit chance
- 0.33%EPSS, 26th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
virtualboxMageia:5 From an advisory covering 8 CVEs | before 5.1.30-1.mga5 | 5.1.30-1.mga5 |
kmod-vboxadditionsMageia:5 From an advisory covering 8 CVEs | before 5.1.30-1.mga5 | 5.1.30-1.mga5 |
kmod-virtualboxMageia:5 From an advisory covering 8 CVEs | before 5.1.30-1.mga5 | 5.1.30-1.mga5 |
virtualboxMageia:6 From an advisory covering 8 CVEs | before 5.1.30-1.mga6 | 5.1.30-1.mga6 |
kmod-vboxadditionsMageia:6 From an advisory covering 8 CVEs | before 5.1.30-1.mga6 | 5.1.30-1.mga6 |
kmod-virtualboxMageia:6 From an advisory covering 8 CVEs | before 5.1.30-1.mga6 | 5.1.30-1.mga6 |
What each source reports
NVD Score used
HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.
- Record
CVE-2017-2730- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.9 Low
AV:A/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.
- Record
CVE-2017-2730- Updated
- 2026-11-02
EUVDEUVD-2017-11873No score
HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.
- Record
EUVD-2017-11873- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wgw9-hgw6-6jgc
HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for...
HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.
- Record
GHSA-wgw9-hgw6-6jgc- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVMGASA-2017-0390No score
Updated virtualbox packages fix security vulnerabilities
This update provides the virtualbox 5.1.30 maintenance release, fixing security and other issues:
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack (CVE-2017-3730).
OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds read when using a specific cipher. By sending specially crafted truncated packets, a remote attacker could exploit this vulnerability using CHACHA20/POLY1305 to cause the application to crash (CVE-2017-3731).
OpenSSL could allow a remote attacker to obtain sensitive information, caused by a propagation error in the BN_mod_exp() function. An attacker could exploit this vulnerability to obtain information about the private key (CVE-2017-3732).
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected (CVE-2017-3733)
A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service (CVE-2017-10392, CVE-2017-10407, CVE-2017-10408).
A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and partially deny service (CVE-2017-10428).
For other fixes in this update see the referenced changelog.
- Record
MGASA-2017-0390- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.