CVE-2018-7911

Vulnerability

The Factory Reset Protection (FRP) bypass vulnerability (CVE-2018-7911) exists in multiple Huawei smart phone models, including ALP-AL00B, BLA-TL00B, Charlotte-AL00A, and Emily-AL00A, running specific versions of Android 8.0 or 8.1. During the reconfiguration process using the FRP function, an attacker can leverage the Gaode Map application to log in to the configuration flow and update the Google account, effectively bypassing the FRP mechanism [1].

Exploitation

An attacker must have physical access to the target device that has been factory reset and is in the FRP lock state. The attacker starts the initial setup flow, opens the Gaode Map app (which is present on the device), and uses it to trigger a sequence of operations that update the Google account linked to the device. No authentication or additional user interaction beyond physical access is required [1].

Impact

Successful exploitation allows the attacker to bypass the FRP protection, thereby gaining full access to the device and its data. This compromises the confidentiality and integrity of user information stored on the device, as the attacker can set up the device as a new user, access personal data, and use the device freely [1].

Mitigation

Huawei released software updates to fix this vulnerability. Users should upgrade their affected devices to the resolved versions specified in the security advisory (e.g., ALP-AL00B to ALP-AL00 8.0.0.152). For other affected models, refer to the advisory for the exact resolved version. If an update is not available, no workaround is provided [1].