CVE-2018-7937

In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature bypass vulnerability due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into installing it. Successful exploit could allow the attacker to obtain the root permission of the device and take full control over the device.

Score

CVSS 3.0 7.8 High

Status

Modified - psirt@huawei.com

Published

2018-09-04

Last modified

2024-08-05

Affected products

• Hirouter-cd20 Firmware (Huawei)
• Ws5200-10 Firmware (Huawei)
• Hirouter-cd20 (Huawei Technologies Co. Ltd.)
• Ws5200-10 (Huawei Technologies Co. Ltd.)

References

• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180827-01-gateway-en