PT-2017-15493 · Huawei · Huawei Mate 9

Published 2017-11-22 · Updated 2017-12-11 · CVE-2017-2706

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei Mate 9 smartphones with software MHA-AL00AC00B125

Description The issue is related to a directory traversal vulnerability in the Push module. This occurs because the system does not verify the file name during decompression, allowing system directories to be traversed. This could potentially be exploited to replace files and impact the service.

Recommendations For Huawei Mate 9 smartphones with software MHA-AL00AC00B125, consider restricting access to the Push module until a fix is available. As a temporary workaround, avoid using the decompression feature in the Push module to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-2706

Affected Products

Huawei Mate 9

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-2706 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20170712-01-push-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2706 · Vendor Advisory