CVE-2018-7937

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature bypass vulnerability due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into installing it. Successful exploit could allow the attacker to obtain the root permission of the device and take full control over the device.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Huawei Technologies Co., Ltd.	HiRouter-CD20, WS5200-10	The versions before HiRouter-CD20-10 1.9.6, The versions before WS5200-10 1.9.6

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180827-01-gateway-enVendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180827-01-gateway-enVendor Advisory

Timeline

Published: Sep 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-79383.3P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission v CVE-2018-79394.6Huawei smart phones G9 Lite, Honor 5A, Honor 6X, Honor 8 with the versions before VNS-L53C605B120CUSTC605D103, the versions before CAM-L03C6 CVE-2018-79406.2Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.0.129(SP2C01) have an CVE-2018-79418.8Huawei iBMC V200R002C60 have an authentication bypass vulnerability. A remote attacker with low privilege may craft specific messages to upl CVE-2018-79427.5The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability. An unauthenticate CVE-2018-79438.8There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass the authentication b CVE-2018-79446.8Huawei smart phones Emily-AL00A with software 8.1.0.106(SP2C00) and 8.1.0.107(SP5C00) have a Factory Reset Protection (FRP) bypass vulnerabi CVE-2018-79464.3There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and CVE-2018-79473.9Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could CVE-2018-79498.8The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker m CVE-2018-79508.8The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input CVE-2018-79518.8The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input