PT-2018-6483 · Huawei · Huawei Hg255S-10

Ahmet Mersin + 2 · Published 2018-06-14 · Updated 2020-01-15 · CVE-2017-17309

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Huawei HG255s-10 version V100R001C163B025SP02

Description: The issue is due to insufficient validation of received HTTP requests, allowing a remote attacker to access local files on the device without authentication. This is a result of a path traversal vulnerability.

Recommendations: For Huawei HG255s-10 version V100R001C163B025SP02, consider restricting access to the device until a patch is available, and avoid using HTTP requests that could potentially exploit the path traversal vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-17309

Affected Products

Huawei Hg255S-10

References · 5

• 🔥 https://github.com/exploit-labs/huawei_hg255s_exploit · Exploit
• https://osv.dev/vulnerability/CVE-2017-17309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17309 · Security Note
• http://huawei.com/en/psirt/security-notices/2017/huawei-sn-20170911-01-hg255s-en · Vendor Advisory
• http://packetstormsecurity.com/files/155954/Huawei-HG255-Directory-Traversal.html · Note