CVE-2016-8273
HighSummary
Huawei PC client software HiSuite 4.0.5.300_OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing. This allows an attacker to launch a MITM attack, potentially compromising the PC.
Risk Assessment
The organization is at risk of attacks that could lead to the installation of malicious software on user computers, resulting in data loss or security breaches.
Recommendation
It is recommended that users update HiSuite to the latest version that uses secure HTTPS protocol and implements integrity checks for downloaded packages.
Other vulnerabilities in Huawei HiSuite 4.0.5.300_OVE
See all- CVE-2016-8274High
Huawei PC client software HiSuite 4.0.5.300_OVE has a DLL hijack vulnerability. An attacker can make the system load malicious DLL files to execute arbitrary code.
- CVE-2016-5821High
Huawei HiSuite versions before 4.0.4.204_ove (Out of China) and before 4.0.4.301 (China) use a weak ACL (FILE_WRITE_DATA for BUILTIN\Users) for the HiSuite service directory. This allows local users to gain SYSTEM privileges via a Trojan horse, such as SspiCli.dll or USERENV.dll files.
Original NVD description (English source)
Huawei PC client software HiSuite 4.0.5.300_OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise the PC.