CVE-2018-7937
High
Description
In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature bypass vulnerability due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into installing it. Successful exploit could allow the attacker to obtain the root permission of the device and take full control over the device.
SeverityHigh
CVSS7.8
Exploit probability58. percentile0.8%
ProductHuawei Hirouter-cd20 Firmware
PublishedSep 4, 2018
First seenSep 4, 2018
How to fix
Update
- huawei hirouter-cd20_firmwarehirouter-cd20-10_1.9.6 or later
- huawei ws5200-10_firmwarews5200-10_1.9.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei hirouter-cd20_firmware | v < hirouter-cd20-10_1.9.6 | hirouter-cd20-10_1.9.6 |
| huawei ws5200-10_firmware | v < ws5200-10_1.9.6 | ws5200-10_1.9.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.