Security readout for executives and security teams
Plain-English summary
This flaw could let an unauthenticated attacker disrupt calling and SMS on affected Huawei Mate 9 Pro phones. The reported impact is loss of phone and text capability, not device takeover or data theft. The source evidence is limited to Huawei/CVE records and does not show active exploitation.
Executive priority
Treat this as a targeted availability risk for legacy mobile devices, not a broad network emergency. Prioritize confirming whether affected handsets remain in use and retiring or updating them if they support business communications.
Technical view
CVE-2017-17175 is a denial-of-service issue in the SMS module of Huawei Mate 9 Pro versions before LON-AL00B 8.0.0.354(C00). The CVE states an attacker may use a pseudo base station and specially crafted malicious SMS to cause call and SMS functions to fail.
Likely exposure
Exposure is limited to organizations or users still operating Huawei Mate 9 Pro devices below LON-AL00B 8.0.0.354(C00). The issue is device-specific and old, so broad enterprise exposure is likely low unless legacy handsets remain in service.
Exploitation context
CISA KEV is false, and the provided sources do not report active exploitation. The described attack requires unauthenticated malicious SMS delivery through a pseudo base station, implying a targeted mobile-radio context rather than ordinary internet exposure.
Researcher notes
No CVSS, CWE, proof of concept, or exploitation confirmation is included in the supplied sources. Analysis should stay bounded to the Mate 9 Pro SMS module and the pre-LON-AL00B 8.0.0.354(C00) firmware range.
Mitigation direction
- Update Mate 9 Pro devices to LON-AL00B 8.0.0.354(C00) or later per Huawei guidance.
- Remove unsupported or unpatchable Mate 9 Pro devices from business use.
- Use MDM inventory to enforce minimum approved firmware builds.
- Review Huawei PSIRT guidance for any model-specific update constraints.
Validation and detection
- Inventory Huawei Mate 9 Pro devices in corporate or managed mobile fleets.
- Verify each device firmware build against LON-AL00B 8.0.0.354(C00).
- Check support status and update availability through Huawei-approved channels.
- Review helpdesk records for unexplained call or SMS failures on affected devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-17175 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180629-01-smartphone-enCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.