CVE-2018-7933: Path Traversal
Huawei home gateway products HiRouter-CD20 and WS5200 with the versions before HiRouter-CD20-10 1.9.6 and the versions before WS5200-10 1.9.6 have a path traversal vulnerability. Due to the lack of validation while these home gateway products install APK plugins, an attacker tricks a user into installing a malicious APK plugin, and plugin can overwrite arbitrary file of devices. Successful exploit may result in arbitrary code execution or privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HiRouter-CD20to a version that resolves this vulnerability.Fixed in HiRouter-CD20-10 1.9.6 - Upgrade
Upgrade
WS5200to a version that resolves this vulnerability.Fixed in WS5200-10 1.9.6 - Compensating control
Prevent installation of APK plugins from untrusted sources on Huawei home gateway devices to reduce the risk of a user being tricked into installing a malicious APK plugin.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-7933.
Which Huawei home gateway products are affected by this vulnerability?
Huawei HiRouter-CD20 and WS5200 with versions before HiRouter-CD20-10 1.9.6 and WS5200-10 1.9.6 are affected.
What is the severity of CVE-2018-7933?
The severity of CVE-2018-7933 is high with a CVSS score of 7.8.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by tricking a user into installing APK plugins that do not undergo proper validation.
Is there a fix available for this vulnerability?
Yes, updating to versions HiRouter-CD20-10 1.9.6 and WS5200-10 1.9.6 will fix this vulnerability.