PT-2017-9798 · Huawei · Utps

Dhruv Shah + 1 · Published 2017-04-02 · Updated 2024-02-14 · CVE-2016-8769

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Huawei UTPS versions earlier than UTPS-V200R003B015D16SPC00C983

Description The issue is related to an unquoted service path, which can lead to the truncation of service query paths. An attacker may exploit this by placing an executable file in the search path of the affected service, potentially obtaining elevated privileges after the executable file is executed.

Recommendations For versions earlier than UTPS-V200R003B015D16SPC00C983, update to UTPS-V200R003B015D16SPC00C983 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-8769

Affected Products

Utps

References · 6

• 🔥 https://exploit-db.com/exploits/40807 · Exploit
• https://osv.dev/vulnerability/CVE-2016-8769 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-utps-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8769 · Security Note
• http://security-geek.in/2017/02/07/0day-discovery-system-level-access-by-privilege-escalation-of-huawei-manufactured-airtel-photon-dongles · Note
• http://securityfocus.com/bid/94403 · Note