CVE-2014-8358: Critical severity huawei ec156 firmware vulnerability

Published Dec 11, 2017

Updated

Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003B015D02SP08C1014 (23.015.02.08.1014) use a weak ACL for the "Mobile Partner" directory, which allows remote attackers to gain SYSTEM privileges by compromising a low privilege account and modifying Mobile Partner.exe.

Affected Software

6 affected components

Huawei Ec156 Firmware=v200r003b009d05sp03c1014

Huawei EC156

Huawei Ec176 Firmware=v200r003b009d05sp03c1014

Huawei EC176

Huawei Ec177 Firmware=v200r003b009d05sp03c1014

Huawei EC177

Event History

Dec 11, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8358?

CVE-2014-8358 is considered a high severity vulnerability due to the potential for remote attackers to gain SYSTEM privileges.

How do I fix CVE-2014-8358?

To mitigate CVE-2014-8358, upgrade the Huawei EC156, EC176, and EC177 USB Modem products to the version UTPS-V200R003B015D02SP07C1014 or V200R003B015D02SP08C1014 or later.

Who is affected by CVE-2014-8358?

Users of Huawei EC156, EC176, and EC177 USB Modem products with firmware versions prior to UTPS-V200R003B015D02SP07C1014 and V200R003B015D02SP08C1014 are affected by CVE-2014-8358.

What type of vulnerability is CVE-2014-8358?

CVE-2014-8358 is a directory access control vulnerability that allows unauthorized access to the "Mobile Partner" directory.

What are the potential impacts of exploiting CVE-2014-8358?

Exploiting CVE-2014-8358 could allow an attacker to execute arbitrary code with SYSTEM privileges on the affected devices.