VulnerabilityModified

CVE-2017-8185

ME906s-158 earlier than ME906S_Installer_13.1805.10.3 versions has a privilege elevation vulnerability.

HIGH 7.8EPSS 0.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

ME906s-158 earlier than ME906S_Installer_13.1805.10.3 versions has a privilege elevation vulnerability. An attacker could exploit this vulnerability to modify the configuration information containing malicious files and trick users into executing the files, resulting in the execution of arbitrary code.

CVSS 3.0: 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-668
Affected: huawei/me906s-158 firmware
Source: psirt@huawei.com

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170927-01-me906s-enVendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170927-01-me906s-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.