CVE-2017-2706: huawei technologies co., ltd. mate 9 Path Traversal

Vulnerability summary

CVE-2017-2706 is a high (CVSS 7.1) Path Traversal vulnerability in huawei technologies co., ltd. mate 9. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58% of scored vulnerabilities.

Timeline

1. 22-11-2017
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in Push module. Since the system does not verify the file name during decompression, system directories are traversed. It could be exploited to cause the attacker to replace files and impact the service.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.