PT-2017-15493 · Huawei · Huawei Mate 9

Publicado 2017-11-22 · Atualizado 2017-12-11 · CVE-2017-2706

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei Mate 9 smartphones with software MHA-AL00AC00B125

Description The issue is related to a directory traversal vulnerability in the Push module. This occurs because the system does not verify the file name during decompression, allowing system directories to be traversed. This could potentially be exploited to replace files and impact the service.

Recommendations For Huawei Mate 9 smartphones with software MHA-AL00AC00B125, consider restricting access to the Push module until a fix is available. As a temporary workaround, avoid using the decompression feature in the Push module to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-2706

Produtos afetados

Huawei Mate 9

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-2706 · Nota de Segurança
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20170712-01-push-en · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2706 · Aviso do Fabricante