CVE-2018-7933
Huawei home gateway products HiRouter-CD20 and WS5200 with the versions before HiRouter-CD20-10 1.9.6 and the versions before WS5200-10 1.9.6 have a path traversal vulnerability. Due to the lack of validation while these home gateway products install APK plugins, an attacker tricks a user into installing a malicious APK plugin, and plugin can overwrite arbitrary file of devices. Successful exploit may result in arbitrary code execution or privilege escalation.
- Score
- CVSS 3.0 7.8 High
- Status
- Modified - psirt@huawei.com
- Published
- 2018-05-10
- Last modified
- 2024-08-05
- Weaknesses
- CWE-22
Affected products
- Hirouter-cd20 Firmware (Huawei)
- Ws5200 Firmware (Huawei)
- Hirouter-cd20 (Huawei Technologies Co. Ltd.)
- Ws5200 (Huawei Technologies Co. Ltd.)
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180502-01-gateway-en
