#VU54505 Path traversal in Huawei products - CVE-2021-22440
Published: July 2, 2021
Vulnerability identifier: #VU54505
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-22440
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Huawei Mate 20
Huawei Mate 20 Pro
Hima-L29C
Laya-AL00EP
OxfordS-AN00A
Huawei Tony-AL00B
Huawei Mate 20
Huawei Mate 20 Pro
Hima-L29C
Laya-AL00EP
OxfordS-AN00A
Huawei Tony-AL00B
Software vendor:
Huawei
Huawei
Description
The vulnerability allows a local attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. An attacker with physical access can connect to the smartphone through a USB cable and access a location that is outside of the restricted directory by a crafted filename
Remediation
Install update from vendor's website.