Path traversal in Huawei Home Music System



Published: 2024-06-25
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2023-7263
CWE-ID CWE-22
Exploitation vector Local network
Public exploit N/A
Vulnerable software
Subscribe 		HarmonyOS AILife Solution 8.0
Hardware solutions / Firmware

Vendor Huawei

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Path traversal

EUVDB-ID: #VU93287

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-7263

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user on the local network can delete the original file in the system or change the permission.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HarmonyOS AILife Solution 8.0: HarmonyOS AILife Audio Service 3.0.2.307

CPE2.3 External links

http://www.huawei.com/en/psirt/security-advisories/2024/huawei-sa-ptvihhms-20747ba3-en


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###