Permissions, Privileges, and Access Controls in Huawei products - CVE-2020-9137

Vulnerability identifier: #VU48749

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9137

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local administrator to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

Huawei CloudEngine 12800
Huawei CloudEngine 7800
Huawei CloudEngine 6800
Huawei CloudEngine 5800

Install updates from vendor's website.

Huawei CloudEngine 12800 - addressed in versions V200R005C10SPC800+V200R005SPH026, V200R019C10SPC800+V200R019SPH006
Huawei CloudEngine 7800 - addressed in versions V200R005C10SPC800+V200R005SPH026, V200R019C10SPC800+V200R019SPH006
Huawei CloudEngine 6800 - addressed in versions V200R005C10SPC800+V200R005SPH026, V200R019C10SPC800+V200R019SPH006
Huawei CloudEngine 5800 - addressed in versions V200R005C10SPC800+V200R005SPH025, V200R019C10SPC800+V200R019SPH006

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201202-02-privilege-en

• Multiple vulnerabilities in Some Huawei Products