Security Advisory - Permission Bypass Vulnerability in Huawei Products
- SA No:huawei-sa-20220819-01-7e0a6103
- Initial Release Date: 2022-08-19
- Last Release Date: 2022-08-19
A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked devices. (Vulnerability ID: HWPSIRT-2021-96118)
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2021-46834.
For products that have released software updates to fix this vulnerability, Huawei will release and update the Security Advisory at:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220819-01-7e0a6103-en
|
Affected Product |
Affected Version |
Resolved Version |
|
JAD-AL50 |
102.0.0.225(C00E220R3P4) |
102.0.0.245(C00E245R3P4) |
Successful exploitation could allow an attacker to access certain resource in the attacked devices.
The vulnerability classification has been performed by using the CVSSv3 scoring system (http://www.first.org/cvss/specification-document).
Base Score: 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Temporal Score: 3.7 (E:F/RL:O/RC:C)
This vulnerability can be exploited only when the following conditions are present:
The attacked device needs to initiate cross device task management to the attacker device.
Vulnerability details:
A permission bypass vulnerability in the cross device task management function of Huawei products. This vulnerability exists because insufficient permission verification. After the attacked device initiates cross device task management to the attacker device, the attacker could exploit the vulnerability through this function. A successful exploit could allow the attacker to access certain resource in the attacked devices.
The vulnerability was discovered by external researchers.
2022-08-19 V1.0 INITIAL
None
Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.
To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.
To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.
