Arbitrary file upload in Huawei Honor_7
CVE-2017-2699
The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload th…
Vulnerability class: Unrestricted File Upload
EPSS: 0.002 (36.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Huawei Honor_7
- Huawei Honor_7_firmware
- Huawei Lyo-l21
- Huawei Lyo-l21_firmware
- Huawei Mate_s
- Huawei Mate_s_firmware
- Huawei Technologies Co., Ltd. Honor 7, Mate S,lyo-l21 — versions Earlier than PLK-UL00C17B385 versions, Earlier than CRR-L09C432B380 versions, Earlier than LYO-L21C577B128 versions
Weakness classification (CWE)
References
- psirt@huawei.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- psirt@huawei.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-2699?
- CVE-2017-2699 is a high-severity vulnerability in Huawei Honor_7, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.8/10. Published 2017-11-22.
- How severe is CVE-2017-2699?
- High severity. CVSS v3 base score is 7.8 out of 10.