CVE-2018-7930

Vulnerability

The Near Field Communication (NFC) module in Huawei Mate 9 mobile phones with versions before MHA-L29B 8.0.0.366(C567) contains an information leak vulnerability. The issue stems from insufficient validation on data transfer requests when the affected phone sends files via NFC to an attacker's phone [1].

Exploitation

An attacker with a mobile phone equipped with NFC can exploit this by initiating a file transfer from the victim's phone. The attacker does not require authentication; they only need to be within NFC range and have the victim's phone send a file. The insufficient validation allows the attacker to request arbitrary files from the victim's phone [1].

Impact

Successful exploitation allows the attacker to obtain arbitrary files from the victim's mobile phone, leading to information disclosure of sensitive data [1].

Mitigation

Huawei has released software update MHA-L29B 8.0.0.366(C567) to fix the vulnerability. Users should upgrade to this version or later. No workarounds are mentioned [1].