Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Huawei apps expose encryption keys and data

CVE-2017-2704 · published 8 years ago
Summary

Several Huawei apps, including Smarthome, HiAPP, HwParentControl and others, store encryption keys in a way that can be reverse‑engineered. An attacker could extract those keys and view sensitive information from the apps. Update to the latest versions of each app as soon as they are available to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
huawei smarthome <= 1.0.2.364
cpe:2.3:a:huawei:smarthome:*:*:*:*:*:*:*:*
huawei hiapp <= 7.3.0.303
cpe:2.3:a:huawei:hiapp:*:*:*:*:*:*:*:*
huawei hwparentcontrol <= 2.0.0
cpe:2.3:a:huawei:hwparentcontrol:*:*:*:*:*:*:*:*
huawei hwparentcontrolparent <= 5.1.0.12
cpe:2.3:a:huawei:hwparentcontrolparent:*:*:*:*:*:*:*:*
huawei crowdtest <= 1.5.3
cpe:2.3:a:huawei:crowdtest:*:*:*:*:*:*:*:*
huawei hiwallet <= 8.0.0.301
cpe:2.3:a:huawei:hiwallet:*:*:*:*:*:*:*:*
huawei huawei_pay <= 8.0.0.300
cpe:2.3:a:huawei:huawei_pay:*:*:*:*:*:*:*:*
huawei skytone <= 8.1.2.300
cpe:2.3:a:huawei:skytone:*:*:*:*:*:*:*:*
huawei hwclouddrive\(emui6.0\) <= 8.0.0.307
cpe:2.3:o:huawei:hwclouddrive\(emui6.0\):*:*:*:*:*:*:*:*
huawei hwphonefinder\(emui6.0\) <= 9.3.0.310
cpe:2.3:a:huawei:hwphonefinder\(emui6.0\):*:*:*:*:*:*:*:*
huawei hwphonefinder\(emui5.1\) <= 9.2.2.303
cpe:2.3:a:huawei:hwphonefinder\(emui5.1\):*:*:*:*:*:*:*:*
huawei hicinema <= 8.0.2.300
cpe:2.3:a:huawei:hicinema:*:*:*:*:*:*:*:*
huawei huaweiwear <= 21.0.0.360
cpe:2.3:a:huawei:huaweiwear:*:*:*:*:*:*:*:*
huawei hihealthapp <= 3.0.3.300
cpe:2.3:a:huawei:hihealthapp:*:*:*:*:*:*:*:*
Original advisory text
Smarthome 1.0.2.364 and earlier versions,HiAPP 7.3.0.303 and earlier versions,HwParentControl 2.0.0 and earlier versions,HwParentControlParent 5.1.0.12 and earlier versions,Crowdtest 1.5.3 and earl...
Smarthome 1.0.2.364 and earlier versions,HiAPP 7.3.0.303 and earlier versions,HwParentControl 2.0.0 and earlier versions,HwParentControlParent 5.1.0.12 and earlier versions,Crowdtest 1.5.3 and earlier versions,HiWallet 8.0.0.301 and earlier versions,Huawei Pay 8.0.0.300 and earlier versions,Skytone 8.1.2.300 and earlier versions,HwCloudDrive(EMUI6.0) 8.0.0.307 and earlier versions,HwPhoneFinder(EMUI6.0) 9.3.0.310 and earlier versions,HwPhoneFinder(EMUI5.1) 9.2.2.303 and earlier versions,HiCinema 8.0.2.300 and earlier versions,HuaweiWear 21.0.0.360 and earlier versions,HiHealthApp 3.0.3.300 and earlier versions have an information exposure vulnerability. Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys, causing information exposure.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published22 Nov 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-2704 · NVD
Track software like this
Free during beta