Path traversal in Huawei products - CVE-2021-22440
Published: July 2, 2021
Vulnerability identifier: #VU54505
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-22440
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Huawei
Affected software:
Huawei Mate 20
Huawei Mate 20 Pro
Hima-L29C
Laya-AL00EP
OxfordS-AN00A
Huawei Tony-AL00B
Huawei Mate 20
Huawei Mate 20 Pro
Hima-L29C
Laya-AL00EP
OxfordS-AN00A
Huawei Tony-AL00B
Detailed vulnerability description
The vulnerability allows a local attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. An attacker with physical access can connect to the smartphone through a USB cable and access a location that is outside of the restricted directory by a crafted filename
How to mitigate CVE-2021-22440
Install update from vendor's website.