NetSight
IP …
high7.8Public exploit code

CVE-2014-8358

Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003B015D02SP08C1014 (2…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003B015D02SP08C1014 (23.015.02.08.1014) use a weak ACL for the "Mobile Partner" directory, which allows remote attackers to gain SYSTEM privileges by compromising a low privilege account and modifying Mobile Partner.exe.

Affected products

VendorProductAffected versions
HuaweiEc156 Firmware
Version v200r003b009d05sp03c1014
HuaweiEc176 Firmware
Version v200r003b009d05sp03c1014
HuaweiEc177 Firmware
Version v200r003b009d05sp03c1014

Weakness classification

CWE-426

References