dbcve.org
Honor 5a FirmwareOperating system · Huawei

CVE-2017-8144

MEDIUM · 5.5 CVSS v3.0 Published 2017-11-22
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
58/100
Remediation priority · Elevated
No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Honor 5A,Honor 8 Lite,Mate9,Mate9 Pro,P10,P10 Plus Huawei smartphones with software the versions before CAM-L03C605B143CUSTC605D003,the versions before Prague-L03C605B161,the versions before Prague-L23C605B160,the versions before MHA-AL00C00B225,the versions before LON-AL00C00B225,the versions before VTR-AL00C00B167,the versions before VTR-TL00C01B167,the versions before VKY-AL00C00B167,the versions before VKY-TL00C01B167 have a resource exhaustion vulnerability due to configure setting. An attacker tricks a user into installing a malicious application, the application may turn on the device flash-light and rapidly drain the device battery.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A configuration vulnerability in multiple Huawei smartphone models allows a malicious application to access and control the device flashlight (torch) without proper restrictions, leading to rapid battery drain through sustained flashlight activation - a form of resource exhaustion DoS.

MitigationUsers should avoid installing applications from untrusted sources. Organizations should deploy MDM policies to restrict application permissions and monitor for battery drain anomalies. Huawei should release firmware updates to implement proper flashlight API access controls and usage timeouts.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Honor 5a FirmwareOperating system
Affected:< cam-l03c605b143custc605d003
Honor 8 Lite FirmwareOperating system
Affected:< prague-l03c605b161< prague-l23c605b160
Mate 9 FirmwareOperating system
Affected:< mha-al00c00b225
Mate 9 Pro FirmwareOperating system
Affected:< lon-al00c00b225
P10 FirmwareOperating system
Affected:< vtr-al00c00b167< vtr-tl00c01b167
P10 Plus FirmwareOperating system
Affected:< vky-al00c00b167< vky-tl00c01b167

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify device model
    Go to Settings > About Phone > Model Number (or use 'getprop ro.product.model' via ADB)
    Affected if Model is Honor 5a, Honor 8 Lite, Mate 9, Mate 9 Pro, P10, or P10 Plus
  2. Check Honor 5a firmware version
    Go to Settings > About Phone > Build Number (or use 'getprop ro.build.version.emui' via ADB). Compare against cam-l03c605b143custc605d003
    Affected if Device is Honor 5a and firmware version is lower than cam-l03c605b143custc605d003
  3. Check Honor 8 Lite firmware version
    Go to Settings > About Phone > Build Number (or use 'getprop ro.build.version.emui' via ADB). Compare against prague-l03c605b161 (for L03) or prague-l23c605b160 (for L23)
    Affected if Device is Honor 8 Lite and firmware version is lower than prague-l03c605b161 or prague-l23c605b160
  4. Check Mate 9 firmware version
    Go to Settings > About Phone > Build Number (or use 'getprop ro.build.version.emui' via ADB). Compare against mha-al00c00b225
    Affected if Device is Mate 9 and firmware version is lower than mha-al00c00b225
  5. Check Mate 9 Pro firmware version
    Go to Settings > About Phone > Build Number (or use 'getprop ro.build.version.emui' via ADB). Compare against lon-al00c00b225
    Affected if Device is Mate 9 Pro and firmware version is lower than lon-al00c00b225
  6. Check P10 and P10 Plus firmware version
    Go to Settings > About Phone > Build Number (or use 'getprop ro.build.version.emui' via ADB). For P10 compare against vtr-al00c00b167 (AL00) or vtr-tl00c01b167 (TL00). For P10 Plus compare against vky-al00c00b167 or vky-tl00c01b167
    Affected if Device is P10 (lower than vtr-al00c00b167 or vtr-tl00c01b167) or P10 Plus (lower than vky-al00c00b167 or vky-tl00c01b167)

Device is affected if it is one of the listed Huawei models and its firmware version is lower than the specified version for that model.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Users should avoid installing applications from untrusted sources. Organizations should deploy MDM policies to restrict application permissions and monitor for battery drain anomalies. Huawei should release firmware updates to implement proper flashlight API access controls and usage timeouts.

Fix this in Honor 5a Firmware Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2017-8144 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2017-8144 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data