Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in Push module.

Published 8 y ago 2017-11-22 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.9%

percentile 59%

Public exploits

none known

Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in Push module. Since the system does not verify the file name during decompression, system directories are traversed. It could be exploited to cause the attacker to replace files and impact the service.

Exploit prediction (EPSS)

0.87% probability of exploitation in the next 30 days, higher than 59% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.1	`CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H`
NVD	2.0	5.8	`AV:N/AC:M/Au:N/C:N/I:P/A:P`

Affected products

Huawei Technologies Co., Ltd. Mate 9

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

huawei.com /en/psirt/security-advisories/huawei-sa-20170712-01-push-en · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-2706
NVD: CVE-2017-2706

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.