SB2023020102 - Multiple vulnerabilities in Huawei Whole-Home Intelligence Software

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Incorrect Privilege Assignment (CVE-ID: CVE-2022-48283)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the affected software does not correctly verify the caller's permission. A local user can use a specially crafted application and access restricted functions.

2) Incorrect Privilege Assignment (CVE-ID: CVE-2022-48284)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the affected software does not correctly verify the caller's permission. A local user can use a specially crafted application and access restricted functions.

Remediation

Install update from vendor's website.

References

• https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-ipavihwhis-1afe7781-en
• https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-ipavihwhis-1556afc2-en