Summaryinfo

A vulnerability identified as critical has been detected in Huawei P7-l10. This impacts an unknown function of the component Installer. The manipulation leads to access control. This vulnerability is listed as CVE-2014-9135. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Huawei P7-l10 (Smartphone Operating System). It has been rated as critical. This issue affects some unknown functionality of the component Installer. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is integrity. The summary by CVE is:

The PackageInstaller module in Huawei P7-L10 smartphones before V100R001C00B136 allows remote attackers to spoof the origin website and bypass the website whitelist protection mechanism via a crafted package.

The weakness was presented 12/19/2014 (Website). The advisory is shared at xforce.iss.net. The identification of this vulnerability is CVE-2014-9135 since 11/28/2014. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version V100r001c00b135 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (99283). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• Huawei

Name

• P7-l10

License

• commercial

Website

• Vendor: https://www.huawei.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion