vulnwire
6.7med

CVE-2016-87691 exploit

Huawei UTPS earlier than UTPS-V200R003B015D16SPC00C983 has an unquoted service path vulnerability which can lead to the truncation of UTPS…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
6.7
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
1
Exploit-DB

Huawei UTPS earlier than UTPS-V200R003B015D16SPC00C983 has an unquoted service path vulnerability which can lead to the truncation of UTPS service query paths. An attacker may put an executable file in the search path of the affected service and obtain elevated privileges after the executable file is executed.

Exploit prediction (EPSS)

1.58% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.

Exploits and detections

  • EDB-40807 Huawei UTPS - Unquoted Service Path Privilege Escalation · local · 2016-11-22

CVSS scores

Assigned byVersionScoreVector
NVD3.16.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Huawei Technologies Co., Ltd. Huawei UTPS

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • security-geek.in /2017/02/07/0day-discovery-system-level-access-by-privilege-escalation-of-huawei-manufactu · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/94403 · vdb-entry, x_refsource_BID, x_transferred
  • huawei.com /en/psirt/security-advisories/huawei-sa-20161116-01-utps-en · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/40807/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.