CVE-2017-2739

Published: Nov 22, 2017Modified: May 13, 2026

3.1

Vector

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 1.6 / Impact: 1.4

Source: NVD

Description

The upgrade package of Huawei Vmall APP Earlier than HwVmall 1.5.3.0 versions is transferred through HTTP. A man in the middle (MITM) can tamper with the upgrade package of Huawei Vmall APP, and to implant the malicious applications.

Affected (1)

Products: Huawei: Vmall

Huawei

1 product

Vmall

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Vmall	Before 1.5.3.0

Related CWEs

CWE-494

Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

References (2)

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170208-01-vmall-en

Source: psirt@huawei.com

Vendor Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170208-01-vmall-en

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.