CVE-2017-15351

Vulnerability

The 'Find Phone' function in Huawei Honor V9 play smartphones running versions earlier than Jimmy-AL00AC00B135 contains an authentication bypass vulnerability. Due to improper authentication realization in the function, the security mechanism can be circumvented [1].

Exploitation

An attacker with physical access to the device can exploit this vulnerability by bypassing the authentication of the 'Find Phone' function. No additional privileges or user interaction are required beyond access to the locked phone [1].

Impact

Successful exploitation allows the attacker to bypass the 'Find Phone' function and use the phone normally, effectively defeating the device's anti-theft protection [1].

Mitigation

Huawei has released software update Jimmy-AL00AC00B135 to fix this vulnerability. Users should update their devices to this version or later. No workarounds are documented [1].