HIGH🇵🇱 Wersja polska

CVE-2018-7937

CVSS 7.8v3.0pub. 2018-09-04upd. 2024-11-21

In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature bypass vulnerability due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into installing it. Successful exploit could allow the attacker to obtain the root permission of the device and take full control over the device.

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Huawei Hirouter Cd20

    HW
    Huawei
    all versions

  • Huawei Hirouter Cd20 Firmware

    OS
    Huawei
    < hirouter-cd20-10_1.9.6

  • Huawei Ws5200 10

    HW
    Huawei
    all versions

  • Huawei Ws5200 10 Firmware

    OS
    Huawei
    < ws5200-10_1.9.6
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2019-5268HIGH8.1same product

Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verif...

CVE-2019-5269HIGH7.8same product

Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certai...

CVE-2018-7933HIGH7.8same product

Huawei home gateway products HiRouter-CD20 and WS5200 with the versions before HiRouter-CD20-10 1.9.6 and the ...

CVE-2019-0708CRITICAL9.8⚠ KEVPL ✓same vendor

BlueKeep — krytyczny RCE w Remote Desktop Services (RDP)

CVE-2026-34865CRITICAL10.0PL ✓same vendor

HarmonyOS: przepełnienie bufora sterty (heap buffer overflow) w module WEB