CVE-2024-47150

Executive Summary

CVE-2024-47150 is a low-severity information leak vulnerability affecting certain Honor products. The vulnerability allows an attacker to leak sensitive information from the device, potentially exposing user data or system details. The CVSS score is 3.3, indicating a low risk, but the lack of a patch and limited public information increases the potential impact for targeted attacks. No proof-of-concept (PoC) code, exploit templates, or patch details are currently available. The vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby).

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: UNKNOWN (No vector string provided)
• Attack Vector: Likely local or adjacent network (based on low score)
• Attack Complexity: Likely low
• Privileges Required: Likely low or none
• User Interaction: Likely none
• Scope: Unchanged
• Confidentiality Impact: Low (information leak)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Low (EPSS 0.0%, no known exploits)

Deep Dive & Mechanics

The vulnerability is described as an information leak in Honor products. Without specific technical details, the likely mechanism involves improper handling of sensitive data during device operations, such as:

• Insecure storage of credentials or tokens.
• Exposure of system logs or debug information.
• Leakage of device identifiers or user data through unencrypted channels.
• Improper access control to device APIs or local resources.

The attack surface is limited to local or adjacent network access, requiring the attacker to have some level of access to the device or its network.

Vulnerable vs. Patched Code

No code samples are available because the vulnerability details are not public. The vendor has not released a patch, and no open-source references exist.

Exploitation & Lab Setup

No exploit code or PoC is publicly available. The following sections provide general guidance for testing and defense.

Red Team

• Reconnaissance: Identify Honor devices on the network using Shodan dorks: "Honor device" or "Honor information leak".
• Exploitation Attempt: If a device is found, attempt to access debug endpoints, read local files, or intercept unencrypted traffic. Example command to test for exposed logs:

  curl http://<device-ip>/debug/logs
  

• Data Exfiltration: If successful, capture leaked data (e.g., tokens, device info) and exfiltrate via a controlled channel.

Blue Team

• Monitor Network Traffic: Look for unusual outbound connections from Honor devices to unknown IPs.
• Check Device Logs: Review device logs for unauthorized access attempts or unexpected data transfers.
• Isolate Devices: Place Honor devices on a separate VLAN with strict access controls.
• Apply Workarounds: If possible, disable unnecessary services or restrict access to debug interfaces.

Indicators of Compromise (IOCs)

• Network: Unusual outbound connections from Honor devices to IPs not in the allowlist.
• File: Presence of unexpected log files or debug output on the device.
• Behavior: Device sending sensitive data (e.g., tokens, serial numbers) over unencrypted channels.

Detection Engineering

YARA Rule

rule CVE_2024_47150_Honor_Info_Leak {
    meta:
        description = "Detects potential information leak from Honor devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47150"
    strings:
        $s1 = "Honor" nocase
        $s2 = "debug" nocase
        $s3 = "token" nocase
        $s4 = "password" nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: Honor Device Information Leak Detection
id: cve-2024-47150
status: experimental
description: Detects network traffic indicative of information leak from Honor devices
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 80
        DestinationHostname: "*honor*"
        PayloadContains: "token"
    condition: selection
falsepositives:
    - Legitimate device updates
level: low

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CVE-2024-47150 Honor Information Leak"; content:"Honor"; nocase; content:"token"; nocase; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

• Vendor Patch: No patch available. Monitor Honor’s security advisories for updates.
• Workarounds:
  • Disable unnecessary services on the device.
  • Restrict network access to the device using firewall rules.
  • Use a VPN or encrypted tunnel for device communication.
  • Regularly audit device logs for suspicious activity.
• Long-term: Replace affected devices with patched alternatives if available.

Valters IT