CVE ID | CVE-2017-15309 |
CVSS SCORE | 4.6, AV:L/AC:L/Au:N/C:P/I:P/A:P |
AFFECTED VENDORS |
Huawei |
AFFECTED PRODUCTS |
Reader |
TREND MICRO CUSTOMER PROTECTION | Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['29907']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com |
VULNERABILITY DETAILS |
The specific flaw exists within the handling of FileName parameters. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. |
ADDITIONAL DETAILS |
Huawei has issued an update to correct this vulnerability. More details can be found at:
http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en |
DISCLOSURE TIMELINE |
|
CREDIT | MWR Labs - Alex Plaskett James Loureiro Robert Miller and Georgi Geshev |