{"id":"CVE-2017-2730","aliases":["EUVD-2017-11873","GHSA-wgw9-hgw6-6jgc","MGASA-2017-0390"],"status":"published","title":"HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for...","description":"HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.","severity":{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00327,"percentile":0.2599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2017-10-27T07:16:04Z","modified":"2026-06-17T01:16:45Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga5"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga5"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga5"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga6"}]}],"bundled":8}],"products":[{"vendor":"huawei","product":"hilink"},{"vendor":"huawei","product":"tech_support"},{"vendor":"huawei technologies co., ltd.","product":"huawei hilink app (for ios), huawei tech support app (for ios)"}],"references":[{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170310-01-hilinkapp-en","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2730"},{"url":"https://github.com/advisories/GHSA-wgw9-hgw6-6jgc"},{"url":"https://advisories.mageia.org/MGASA-2017-0390.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21901","tags":["report"]},{"url":"https://www.virtualbox.org/wiki/Changelog-5.1#v30","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-2730","description":"HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.","status":"published","published":"2017-11-22T19:00:00Z","modified":"2024-09-16T19:40:04.204Z","updated_at":"2026-11-02T14:33:15.887816Z"}],"euvd":[{"id":"EUVD-2017-11873","description":"HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.","status":"published","published":"2017-11-22T19:00:00Z","modified":"2024-09-16T19:40:04Z","updated_at":"2026-11-03T00:55:20.992168Z"}],"ghsa":[{"id":"GHSA-wgw9-hgw6-6jgc","title":"HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for...","description":"HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.","status":"published","published":"2022-05-17T00:16:44Z","modified":"2023-02-03T05:01:21Z","cvss":[{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:57.625741Z"}],"nvd":[{"id":"CVE-2017-2730","description":"HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version.","status":"published","published":"2017-11-22T19:29:01.74Z","modified":"2026-06-17T01:16:45.603Z","cvss":[{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.9,"vector":"AV:A/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"MGASA-2017-0390","title":"Updated virtualbox packages fix security vulnerabilities","description":"This update provides the virtualbox 5.1.30 maintenance release, fixing\nsecurity and other issues:\n\nIn OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad\nparameters for a DHE or ECDHE key exchange then this can result in\nthe client attempting to dereference a NULL pointer leading to a\nclient crash. This could be exploited in a Denial of Service attack\n(CVE-2017-3730).\n\nOpenSSL is vulnerable to a denial of service, caused by an out-of-bounds\nread when using a specific cipher. By sending specially crafted truncated\npackets, a remote attacker could exploit this vulnerability using\nCHACHA20/POLY1305 to cause the application to crash (CVE-2017-3731).\n\nOpenSSL could allow a remote attacker to obtain sensitive information,\ncaused by a propagation error in the BN_mod_exp() function. An attacker\ncould exploit this vulnerability to obtain information about the private\nkey (CVE-2017-3732).\n\nDuring a renegotiation handshake if the Encrypt-Then-Mac extension is\nnegotiated where it was not in the original handshake (or vice-versa)\nthen this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on\nciphersuite). Both clients and servers are affected (CVE-2017-3733)\n\nA local user can exploit a flaw in the Oracle VM VirtualBox Core component\nto partially access data, partially modify data, and deny service\n(CVE-2017-10392, CVE-2017-10407, CVE-2017-10408).\n\nA local user can exploit a flaw in the Oracle VM VirtualBox Core component\nto partially access data, partially modify data, and partially deny service\n(CVE-2017-10428).\n\nFor other fixes in this update see the referenced changelog.\n","status":"published","published":"2017-10-27T07:16:04Z","modified":"2026-04-16T06:26:04.524149011Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}