CVE-2017-10709 - Vulnerability Details - OpenCVE

The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspace after each PIN guess.

No CVSS v4.0

No CVSS v3.1

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Elephone	P9000
Google	Android

Configuration 1 [-]

AND

cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*

cpe:2.3:h:elephone:p9000:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/
https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilen
https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707
https://www.trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0
https://www.youtube.com/watch?v=dwyzonP2eZw

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-06-30T16:00:00Z

Updated: 2024-09-16T20:22:42.916Z

Reserved: 2017-06-30T00:00:00Z

Link: CVE-2017-10709

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-06-30T16:29:00.197

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-10709

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspace after each PIN guess."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-30T16:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilen"}, {"tags": ["x_refsource_MISC"], "url": "https://www.trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0"}, {"tags": ["x_refsource_MISC"], "url": "https://www.youtube.com/watch?v=dwyzonP2eZw"}, {"tags": ["x_refsource_MISC"], "url": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-10709", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspace after each PIN guess."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/", "refsource": "MISC", "url": "https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/"}, {"name": "https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilen", "refsource": "MISC", "url": "https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilen"}, {"name": "https://www.trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0", "refsource": "MISC", "url": "https://www.trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0"}, {"name": "https://www.youtube.com/watch?v=dwyzonP2eZw", "refsource": "MISC", "url": "https://www.youtube.com/watch?v=dwyzonP2eZw"}, {"name": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707", "refsource": "MISC", "url": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T17:41:55.738Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilen"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.youtube.com/watch?v=dwyzonP2eZw"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-10709", "datePublished": "2017-06-30T16:00:00Z", "dateReserved": "2017-06-30T00:00:00Z", "dateUpdated": "2024-09-16T20:22:42.916Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elephone:p9000:-:*:*:*:*:*:*:*", "matchCriteriaId": "5187DC73-16BD-4C15-8560-43883CFF2896", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspace after each PIN guess."}, {"lang": "es", "value": "La pantalla de bloqueo en dispositivos Elephone P9000 (que ejecutan Android 6.0) permiten que atacantes f\u00edsicamente cercanos omitan una caracter\u00edstica de bloqueo de PIN incorrecto pulsando retroceso tras cada adivinaci\u00f3n de PIN."}], "id": "CVE-2017-10709", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-30T16:29:00.197", "references": [{"source": "cve@mitre.org", "tags": ["Press/Media Coverage", "Third Party Advisory"], "url": "https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilen"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0"}, {"source": "cve@mitre.org", "tags": ["Press/Media Coverage", "Third Party Advisory"], "url": "https://www.youtube.com/watch?v=dwyzonP2eZw"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Press/Media Coverage", "Third Party Advisory"], "url": "https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilen"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Press/Media Coverage", "Third Party Advisory"], "url": "https://www.youtube.com/watch?v=dwyzonP2eZw"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}